Security at Growvo.AI

All traffic is served over TLS. Sensitive credentials — third-party integration tokens and any AI provider keys you bring — are encrypted at rest with AES-256-GCM and only decrypted in memory when a request needs them.

Passwords are hashed with bcrypt and never stored in plaintext. Accounts can enable TOTP two-factor authentication, and every session is individually revocable. Login is rate-limited to blunt credential-stuffing.

Every workspace enforces owner / admin / editor / viewer roles from a single server-side permission matrix. Roles are resolved from your membership record on each request — never trusted from the client.

Data is scoped to your workspace at the query layer, and workspace boundaries are enforced on every read and write so one tenant can never see another tenant’s content, brands, or analytics.

Sensitive actions — sign-in, password and 2FA changes, member changes, API-key issue/revoke, integration connect/disconnect, plan changes, publishing, and data erasure — are written to an append-only audit log, with credential-looking values scrubbed before they are stored.

Per-IP rate limiting, request-scoped context and request ids, SSRF protection on outbound integration calls, quota enforcement, and error monitoring keep the platform resilient and observable.

Workspace admins can export a complete JSON archive of the workspace — profile, brands, generated outputs, calendar, connected-integration metadata (never the tokens), and usage — for portability and DSAR fulfilment.

You can permanently delete a workspace and its data, or erase your entire account. Deletion cascades across the workspace’s records; personal data is removed, with the security audit trail retained as required for accountability.