Security

Sign-in is handled through our managed authentication provider. Sessions are bound to your account, and every request to backend data is authorized server-side. Workspace membership controls who can read or change data, and roles (owner, admin, member, viewer) gate sensitive actions such as inviting members or transferring ownership.

Every workspace's data lives in its own row-level-security-scoped rows in a shared Postgres database (Supabase). One workspace's rows are not queryable from another's session, enforced at the database layer, not just the application layer. Billing identifiers and invitation tokens are restricted to server-side roles and are never exposed to other members.

Connection credentials and API keys you bring into Cadence are encrypted before being stored. Decryption happens only inside server-side code paths. Data in transit uses TLS provided by the hosting platform.

Every connected source (GitHub, Slack, Linear, and similar) uses that provider's OAuth flow with the minimum scope the feature needs, shown to you before you grant it. Tokens are encrypted at rest. Disconnect any source anytime from Settings; access ends immediately.

Agents can draft, propose, and build, but nothing merges, ships, or takes an irreversible outward action without a human approval through the real approval flow. This is a fixed floor, not a setting that can be dialed away.

Your product's decisions, specs, and code are not used to train a shared model. See the privacy policy for the full statement.

Cadence relies on infrastructure and AI providers to deliver the product, and on third-party services that you explicitly connect (for example a code repository or calendar). The full, live list of sub-processors and what each one receives is public at the sub-processor disclosure. Connections you create are scoped to your workspace, and you can disconnect them at any time from Settings.

You can delete data you have created (workspaces, products, documents, signals) from inside the app, and export your data in open formats from Settings. Account deletion or data export requests can also be made through the contact address on your account.

If you find a security issue, tell us before you tell anyone else. Reach us through the contact address on your account. We will acknowledge real reports and keep you posted as we fix them.

We do not currently hold a SOC 2 or ISO 27001 certification. If your evaluation needs one, tell us. It tells us where to invest next, and we would rather hear it than have you assume otherwise.