Security

How we approach security

Attemper holds the credentials to the services you connect and acts in them for you, so protecting those credentials is the core of the product. This page describes what Attemper does today. It does not describe certifications or audits, because we do not have any yet. When that changes, this page will say so.

Your credentials

• Encrypted at rest, one key each. Every OAuth token and API key you give us, and every webhook signing secret, whether you paste it or we create it, is encrypted with AES-256-GCM using its own data key. Each data key is itself encrypted with a master key that is kept outside the database, in our hosting provider's encrypted configuration, so a copy of the database alone does not reveal a credential.
• Kept apart. Credentials live in a separate part of the database that the application's public interfaces cannot reach. One part of the code reads them, over a direct connection.
• Never shown. A connection's credentials are never returned to the dashboard, never written to logs, and never shown to an agent. Agents use your connections through Attemper without seeing the keys.
• Removed when you disconnect. When you remove a connection, its stored credentials are deleted.

Keys and secrets we issue

App keys, and the secret part of each webhook address, that Attemper creates are shown to you once, when they are made. We store a one-way fingerprint of the whole key (a SHA-256 hash), which lets us check a key without being able to reveal it, and the key's first few characters so you can tell your keys apart. We never store the whole key. If you lose one, you make a new one and remove the old one. A webhook that checks a sender's signature needs the signing secret itself to do so, so signing secrets are stored encrypted like your other credentials.

Your data

• Separate workspaces. Database access rules keep each workspace's data apart for requests made as you or your agent. For requests that arrive without a signed-in person, such as a webhook delivery, an app's call or a scheduled run, the server identifies the key, address or entry point first and works only with that workspace's data.
• A record the app cannot rewrite. The log of what ran is append-only through the application's interfaces: they can add to it but cannot change or delete an entry, except that deleting content removes an entry's values and responses and keeps its skeleton.
• Encrypted in transit. Attemper's pages and APIs are served over HTTPS.
• Hosting. Attemper runs on cloud providers in the United States, listed on our Subprocessors page.

Calls to your services

• Encrypted connections. Attemper connects to the servers and APIs you add over HTTPS.
• Guarded addresses. Before connecting, and again at every redirect, Attemper checks where an address points and refuses private, loopback and link-local addresses. This helps keep a connection from being used to reach systems inside a private network.
• Signed webhooks. A webhook address can require the sender's signature, in the formats common senders use, and refuses a delivery that does not carry a valid one.

Signing in

Sign-in is handled by our database provider's authentication service, which stores passwords only as salted hashes. You sign in with your password. To confirm your address or reset your password, we email you a link or a code, which signs you in once. An agent connects to Attemper through a standard OAuth authorization flow, where you see what it is asking for and choose Allow, and you can disconnect it at any time.

Inside Attemper

Access to production systems is limited to the people who need it to run the service. Our staff access customer data only as our Terms allow: to provide and support the service, to keep it secure and investigate misuse, to comply with the law, and to prepare de-identified data for training while training is on. Our staff read customer data directly, never through an AI model service.

If something goes wrong

If we discover a breach of security that leads to the loss, alteration, or unauthorized disclosure of or access to your data or credentials in our systems or our subprocessors' systems, we will tell your workspace's owner immediately, even while we are still investigating, and in any case within 72 hours, share what we know, and keep you updated, as our Terms and Data Processing Addendum commit.

Reporting a vulnerability

If you think you have found a security problem in Attemper, email [contact email] with the details and the steps to reproduce it. Please give us a reasonable time to fix it before telling anyone else.

While you research, test only against your own account and data, do not access or change other customers' data, do not degrade the service for others, and stop and tell us as soon as you find a problem. If you follow these rules and act in good faith, we will not pursue legal action against you for your research, and we will work with you to understand and fix the issue.

What we do not offer yet

So you can plan around them, these are not available today:

• Two-step sign-in. Signing in to Attemper takes one step: your password, or a link or code we email you.
• Single sign-on. You cannot sign in to Attemper through your company's identity provider.
• An independent security audit or certification. No outside firm has audited or certified Attemper.

What you can do

• Use a strong, unique password for your Attemper account.
• Give Attemper credentials with the least access your runbooks need, such as a read-only database user for read-only runbooks.
• Keep app keys and webhook addresses secret, and replace any you think are exposed.
• Remove agents, keys, webhooks and connections you no longer use.
• Mark steps that move money or delete data to ask first.