Security

Polywei runs on Google Cloud Platform. Application traffic is served over HTTPS, and database connections are TLS-enforced. Production databases are not exposed to the public internet for direct connections.

Every workspace lives in its own isolated database schema, and database-level row security backstops application-level checks. Enterprise plans can additionally host their workspace data in a database they control (bring-your-own data plane). Self-hosting or bring-your-own data plane applies to your Customer Data only; the Polywei software, engine, schematics, and documentation remain Polywei’s property and are licensed, not sold, as described in our Terms of Service.

Data is encrypted in transit (TLS) and at rest. Sensitive credentials — integration tokens, billing credentials, and connection strings — are additionally envelope-encrypted with a data-encryption key dedicated to each workspace. Deleting a workspace destroys its keys, cryptographically shredding the encrypted material.

Sign-in uses single sign-on and passkeys — Polywei does not store passwords. Workspace access is invitation-gated and governed by role-based permissions, with section-level access controls for members. API keys are scoped, rotatable, and rate-limited.

For enterprise, downloadable, and local deployments, Polywei may use license keys, activation, and validation telemetry to secure and protect the software. Customers are responsible for the security of the infrastructure on which they run a self-hosted edition. These deployments remain subject to the license and restrictions in our Terms of Service, including the prohibitions on reverse engineering, copying, and disclosure of the software and its architecture.

Administrative and data-changing actions are recorded in an audit trail available to workspace administrators. Platform services are monitored, and failures surface loudly rather than silently degrading.

If you believe you have found a security vulnerability, report it to [email protected] with enough detail to reproduce the issue. We will acknowledge reports promptly and keep you informed as we investigate. Please do not publicly disclose a vulnerability or the details of our security architecture before we have had a reasonable opportunity to respond.