Security Policy

Panzoe connects to sensitive parts of your life, so we document security honestly. This page describes only protections that are implemented today; it is updated as the platform evolves.

• Passwords are hashed with bcrypt (salted, adaptive) — never stored or logged in plain text.
• Sessions use httpOnly, Secure, SameSite cookies — session tokens are not accessible to page scripts.
• Repeated failed logins trigger temporary account lockout to resist brute-force attacks.
• Logging out invalidates the server-side session.

• Google and Microsoft connections use the OAuth 2.0 authorisation-code flow — Panzoe never sees or stores your Google or Microsoft password.
• Access and refresh tokens are encrypted at the application layer before storage and decrypted only in memory when calling provider APIs.
• OAuth state tokens are single-use and consumed atomically, protecting the connection flow against CSRF and replay.
• We request the minimum scopes each service needs, and you can revoke any connection instantly from the Integration Hub (and additionally from your Google or Microsoft account settings).

• All traffic is encrypted in transit with TLS 1.2+ and HTTP Strict Transport Security.
• Workspaces are strictly isolated — every query is scoped to your workspace; no user can access another workspace's data.
• Role-based permissions govern connected data: raw mailbox access is limited to workspace owners and admins, and admins can restrict which assistants and areas may use each integration.
• Security headers including a restrictive Content-Security-Policy, X-Frame-Options (clickjacking protection) and Permissions-Policy are enforced on the API.

• Any AI action that writes to your accounts (drafting an email, creating a calendar event) requires your explicit in-conversation confirmation, and drafts are never sent automatically.
• Every AI tool action against connected accounts is recorded in an audit log.
• AI requests to model providers exclude unnecessary identifiers.

We log authentication events, integration errors and AI failures, and monitor for anomalies such as failed-login spikes. If we become aware of a security incident affecting your personal data, we will investigate promptly and notify affected users and, where required, regulators without undue delay (within 72 hours for GDPR-relevant breaches).

Use a strong unique password, keep your email account secure (it can reset your password), and review connected integrations periodically. Report anything suspicious to security@panzoe.ai.

We welcome good-faith security research — see our Vulnerability Disclosure Policy at /legal/vulnerability-disclosure.