Your users' credentials, handled with care

Encryption at rest

Access tokens, refresh tokens, API keys, OAuth client secrets and webhook secrets are sealed with AES-256-GCM, a fresh random IV per value. The key lives only in the server environment, never in the database.

Credentials never leave the server

The API returns a connected account's status and metadata, never its token. Tools receive the credential inside our server process for the one request that needs it. Logs mask any field whose name looks like a secret.

Project API keys

We store only a SHA-256 hash of each key and show the key once. Keys can be revoked at any time. MCP keys can be scoped to one server and one user id, so a leaked URL opens only that user's tools on that server.

OAuth done properly

Authorisation uses a single-use state value and PKCE where the provider supports it. Connect links expire after one hour. A replayed callback is refused.

Proxy calls stay on the app's host

Raw proxy requests accept a path only. They always go to the toolkit's own API host, so a connection's token can't be sent elsewhere.

Signed webhooks, both ways

Incoming deliveries from GitHub, Stripe and others are checked against the provider's signature before they are stored. Our deliveries to you carry a Standard Webhooks HMAC-SHA256 signature over id, timestamp and body.

Where the data lives

The database runs on Neon in Frankfurt (EU). The application runs on Vercel. The operator is dionics media UG in Germany.

Deleting data

Deleting a connected account removes its credentials at once. Deleting a project removes its keys, configs, accounts, triggers and logs. Deleting your account deletes the projects you own.

Found a vulnerability? Write to websites@dionics.ai..