Security
Security is the product.
Detecte sits between your agents and your most sensitive systems. Below is a working summary of how we protect customer data and how you can verify our claims.
TLS 1.3 in transit. AES-256 at rest on Neon Postgres. Backups encrypted. No raw secrets stored — API keys are HMAC-hashed with a per-deployment signing secret and shown to you exactly once.
API keys are 32-byte URL-safe random values, prefixed sk_test_ or sk_live_. Dashboard auth runs on Clerk with optional SSO and 2FA on every plan.
Every webhook is HMAC-SHA256-signed over {timestamp}.{payload}. The 5-minute timestamp window protects against replay. Verify with Detecte.webhooks.verify().
Mark fields as sensitive on a verify call and Detecte HMAC-hashes the values before storage. Originals never reach our database. Equality-based policies still work because the hash is deterministic per workspace.
Every state change — policy created, key revoked, agent re-tiered, incident resolved — is recorded with actor, timestamp, and decision linkage. Append-only; deletes are not exposed. Tamper-evident hash chaining is on the roadmap for late 2026.
US-East today (iad1). EU (fra1) and APAC (sin1) deployments are next on the roadmap; per-workspace region pinning is supported in the SDK.
Found something? Email security@detecte.xyz. Triage within 48 hours; coordinated disclosure standard. A bug-bounty program on HackerOne opens with our SOC 2 audit.
SOC 2 Type II evidence-gathering is in progress (Vanta). GDPR DPAs available on request. HIPAA, ISO 27001, and EU AI Act readiness are being scoped.
Procurement, security review, or a SIG / CAIQ request?
security@detecte.xyz