Secure by default, at every layer.
Setu holds tokens for other people's accounts. Here is exactly how the vault, the sign-in flow and the request guards work, and what is still on the list.
Encryption at rest
AES-256-GCM with a key per token, wrapped by a master key, bound to its connection.
Replay-proof sign-in
OAuth state is random, single-use, hashed and expires in 10 minutes. PKCE where supported.
Fenced outbound calls
Each integration reaches only its own HTTPS host, with private-address and DNS-rebinding checks.
Tenant isolation
Every query carries a project id. API keys are stored as hashes and shown once.
Least privilege
Scopes are requested per toolkit, actions carry risk levels, and sessions are allow-listed.
No payload storage
Logs hold metadata only. Tokens never appear in logs or errors.
Responsible disclosure.
Email [email protected]. We acknowledge within three business days and coordinate disclosure within 90 days.
Give your agent real hands.
Connect an app, hand your agent the tools, and watch it finish the job.