Security, stated plainly.
Here's what SourceBackedactually does to keep your documents isolated and protected, and what we haven't built yet. No badges we haven't earned.
Workspaces are isolated by construction
Every document, chunk, and conversation is tagged with its workspace on write. Every read filters by that same workspace ID, at the database layer and again in the search index, before your membership in that workspace is even checked. There's no code path that returns another workspace's data.
Encrypted in transit and at rest
Documents are stored in an encrypted, versioned S3 bucket. Structured data lives in DynamoDB, encrypted at rest by default. All API traffic runs over HTTPS.
Secrets stay out of application code
Signing keys and API credentials are pulled from AWS Secrets Manager and Parameter Store at process start, not stored in a config file or an environment variable checked into anything.
Authentication is short-lived by default
Access tokens expire after 8 hours. Sessions refresh silently in the background, so you don't feel it, but nothing stays valid indefinitely if a token were ever exposed.
Your documents don't train anything
Uploaded documents are used to answer your questions inside your workspace. They aren't used to train a shared model, and they aren't visible to other customers, ever.
Deletion is real
Deleting a workspace marks it and its data as removed immediately and it drops out of every listing and search result right away.
Refresh tokens never touch JavaScript
Your session's refresh token lives in an httpOnly cookie the browser holds, not localStorage. Page JavaScript, including a malicious script from a future bug or a compromised dependency, cannot read it, and every place that credential gets used is checked against a second, CSRF-specific token.
What we don't have yet
A security page that only lists strengths is marketing, not information. Here's what's still missing, as of now.
- We are not SOC 2 or ISO 27001 certified yet. If that's a requirement for your organization, tell us, it's on our roadmap and we'd rather say so now than imply otherwise.
- No SSO/SAML, no signed DPA, and no data residency options yet. All three are planned for the Enterprise tier, not available today.
- There's no audit log UI yet for admins to review who accessed what inside a workspace.
- Workspaces currently have a single owner, not multiple members with different roles. Team-based permissions are planned, not shipped.
Have a specific security or compliance question? Email security@sourcebacked.ai and a person will answer, not a template.