Security / Overview

Security

Security is part of the product.

Use these defaults to keep Finkkle accounts, workspaces, integrations, and generated work protected.

Authentication

Use short-lived sessions in browsers and scoped, server-side API keys for integrations. Never put a secret in client JavaScript, a public repository, or a prompt. Revoke keys immediately when access changes.

Workspace access

Give each collaborator the least access they need. Review members, connected plugins, and automation permissions regularly. Treat shared Spaces as team-visible unless your workspace policy says otherwise.

Privacy & data

Only send the data needed for the task. Remove credentials and personal information from files before uploading. Keep an audit trail for consequential automation and review generated outputs before publishing.

Incident response

  1. Stop the affected integration and revoke credentials.
  2. Capture request IDs, timestamps, and the smallest useful evidence.
  3. Notify your workspace owner and contact support with the incident summary.
Security boundaryFinkkle cannot infer access you have not explicitly granted. Make context, permissions, and external actions visible in your product.