Security

Security is part of the design, not an add-on

Your designs, accounts and payments are protected at every layer, from the browser to the database.

One sign-in, three apps

The apps never see your password or your website session. They receive a one-time code that lasts 60 seconds and exchange it server to server. Signing out anywhere signs you out everywhere.

MFA & social sign-in

Google and Microsoft sign-in, plus TOTP two-factor authentication with any authenticator app.

Secure sessions

Signed JWT sessions in HttpOnly, Secure, SameSite cookies, revocable per device, with a limit on concurrent devices.

CSRF & input validation

Double-submit CSRF tokens on every state-changing request and strict schema validation of all input.

Rate limiting

Per-IP and per-user limits on sign-in and other sensitive requests protect against brute force and abuse.

Server-side access control

Roles, product access and trial limits are checked by the server on every request, never in browser code.

Data isolation

Projects and knowledge-base documents are private to their owner in every app, and every account query is scoped to the signed-in user. With Supabase, Row Level Security adds a second barrier in the database.

PCI-safe payments

Razorpay handles card, UPI and bank details. We store only payment IDs and status, and verify every payment signature.

Audit logging

Sign-ins, setting changes, payments and admin actions are recorded with time, IP and user agent.

HTTPS & security headers

TLS everywhere with HSTS, Content-Security-Policy, X-Frame-Options and a strict Referrer-Policy.

SQL-injection safe

All database access goes through parameterised queries; no SQL is built from user input.

Your LLM, your data

You connect your own LLM: OpenAI, Gemini, or an Ollama server on your own network, which keeps everything there. A cloud provider receives prompts only if you connect one. Your key is stored encrypted and handed to an app only while a run needs it. Demo mode sends nothing to any model. Enterprise can run fully on-premise.

Found a vulnerability? Please e-mail contact@mithratinyai.com — we respond quickly to responsible disclosures.