Security
Security at Conduet
How we protect your data and your customers' data.
Encryption
All data is encrypted in transit (TLS 1.2+) and at rest. API keys and secrets stored in Conduet are encrypted using AES-256 before being written to the database.
BYOK — Bring Your Own Keys
On Pro and Scale plans, your OpenAI and Anthropic API keys are used directly. LLM requests go from Conduet servers to your vendor account — we never proxy through a shared key. Your keys are encrypted at rest and never logged.
Authentication
Conduet uses Supabase Auth with cookie-based sessions. We support email/password and Google OAuth sign-in. Sessions are httpOnly cookies — no tokens are stored in localStorage.
Data residency
All project data (workflows, conversations, knowledge base documents) is stored in PostgreSQL. Paid plans include Australian data residency options. Scale plan customers get dedicated infrastructure.
Access control
Workspace members have role-based access (owner, admin, member). API keys use thecdt_*prefix and are scoped to individual projects. Audit logging tracks all administrative actions.
Responsible disclosure
If you discover a security vulnerability, please report it to security@conduet.ai. We take all reports seriously and will respond within 48 hours.