Security
Your brand strategy is company information. It is treated that way.
Stylaform holds brand decisions, the reasoning behind them and sometimes unreleased product direction. This page describes the principles the application is built on, at a level that is useful without being a map for anyone hostile.
Principles
How the application is built.
- Multi-tenant workspace isolation
- Data belongs to a workspace, and access is scoped to that workspace.
- Server-side authorization
- Permission decisions are made on the server, never inferred from the browser.
- Row Level Security
- Authorization is enforced at the database layer as well as the application layer.
- Private application tables
- Application data is not publicly readable.
- Magic-link authentication
- Sign-in uses emailed links, so there is no password for you to reuse or for us to store.
- Private asset storage
- Uploaded assets are stored privately rather than on a public URL.
- Bounded AI access
- AI features operate within the authorized task and workspace.
- AI cost controls
- AI usage is bounded, so a runaway process cannot quietly consume resources.
- Audit logging for sensitive actions
- Sensitive actions are recorded so they can be reviewed.
Specific implementation details, infrastructure names, endpoints and configuration are deliberately not published.
Certifications
No certifications are claimed.
Stylaform is an early-stage product. It does not hold SOC 2, ISO 27001 or HIPAA attestations, and has not completed a third-party penetration test. When any of that changes, it will be stated here plainly and not before.
AI and security are separate questions.
How Stylaform limits what AI can see and do has its own page.