🔒 Security overview

Every business is isolated

Every database query is scoped to your business by a fail-closed guard: an operation the guard does not recognize throws an error instead of running unprotected. Cross-account access attempts return nothing.

Access and secrets

• Role-based access: Owner ⊇ Admin ⊇ Staff, with Customer as a separate portal audience.
• Passwords hashed with bcrypt; sessions are short-lived tokens with revocable refresh tokens.
• Integration credentials encrypted at rest with AES-256.
• Public API access uses scoped keys with per-key rate limits.

AI actions are governed and logged

AI employees act through one enforced gateway: tool permission, argument validation and authority checks happen in platform code the model cannot influence. Outside-impact actions can require human approval, every decision is recorded with its reason, and AI usage is tracked per call.

Honest compliance posture

Sofilic does not currently hold a formal compliance certification, and we say so rather than imply otherwise. We provide privacy-supporting tooling — consent records, data export, and erasure workflows to support GDPR/PIPEDA-style requests. The full engineering detail lives on the Security page.

Still stuck?

Support and the contact form reach a human.