Security
How SageOps protects your account.
A short, factual summary of the controls in the product today. It is not a certification and makes no promise beyond our Terms of Service.
Signing in
- Passwords are stored only as salted scrypt hashes, never in readable form.
- Sessions use random tokens that we store only in hashed form. The browser holds them in an HTTP-only cookie that page scripts cannot read.
- Two-factor authentication with an authenticator app is available to every user, with one-time recovery codes for a lost device.
- Resetting a password signs out every existing session for that account.
Access inside your organization
- Each organization is a separate tenant. Workspace data is scoped to the organization that owns it, and a person outside it is refused.
- Members hold one of four roles: owner, admin, member or viewer. Viewers can read but not change anything, and managing members and invitations needs an admin.
- Items can be kept private to the person who created them, or shared with the organization or a named teammate.
What Sage is allowed to do
- Anything Sage would publish or send is held for approval by default. You choose, per channel, whether it asks first, publishes on its own, or is never allowed.
- Capabilities that are switched off for your organization are withheld from Sage entirely, not just hidden in the interface.
- Spend limits can stop a run that goes past its budget while it is still running.
- Every action Sage takes is recorded in the run history, attributed to the person or schedule that started it.
Connected accounts and email
- Tokens for the channels you connect are kept in an encrypted secret store, separate from workspace content, and are never shown back in the interface.
- Every client email carries a signed unsubscribe link, and unsubscribed recipients are suppressed from future sends.
Infrastructure
- SageOps runs on Microsoft Azure and is served over HTTPS only.
- SageOps does not currently hold third-party security certifications. We will say so here when that changes.
Reporting a problem
If you believe your account has been accessed without permission, or you have found a security issue, email legal@mindhyve.ai. Please do not test against other customers' accounts.