Skip to main content
This page summarizes how Auxilian protects your account and data. For questions, email [email protected].

​
Authentication

  • Google sign-in only. Auxilian has no passwords. You sign in with Google through WorkOS AuthKit, a hosted sign-in page. Auxilian receives your name, email address, and profile picture, and never your Google password or other Google data.
  • Encrypted session cookies. Web sessions use encrypted, HTTP-only cookies that last up to 24 hours and refresh while you’re active.
  • Sign-out ends the session. Logging out ends your session on the sign-in provider too, not only in the browser tab.
  • Sign-in protection. The sign-in flow uses a one-time state value to block forged sign-in callbacks, and sign-in attempts are rate limited per IP address.

​
AI assistant connections

  • OAuth 2.1 with PKCE. Assistants never see your Google credentials. They receive a token after you approve them on Auxilian’s consent page.
  • Explicit consent. The consent page names the app, the account, the scopes, and where access is sent. It can’t be framed by other sites, and its form is protected by a single-use nonce. See Authorization.
  • No extra privileges. A token identifies you and its scopes. Your permissions are looked up on every call, so revoking access takes effect immediately.
  • Destructive tools are labeled. Tools that delete data carry destructiveHint, so clients can ask before running them.

​
Project isolation

  • One schema per project. Each project’s tables live in a separate Postgres schema. Every query names its project’s schema explicitly, after an access check for that project.
  • Least-privilege database role. The application connects as a dedicated Postgres role that is not a superuser and can’t bypass row-level security. Row-level security is enabled on every internal table.
  • No SQL from callers. Neither the web app nor MCP tools accept SQL. Table and column names are checked against a strict allowlist pattern and quoted. Values are always sent as bound parameters.
  • No existence oracle. A project that doesn’t exist and a project you can’t access return the same Access denied error.
  • Query time limit. Every query is limited to 5 seconds.

​
Auditing

Every schema change, row write, and sharing change is written to the project’s activity log in the same database transaction as the change. Refused writes are logged as write.denied. See Activity events.

​
Data handling

The Privacy Policy and Terms of Service govern how Auxilian handles your data and your use of the service.

​
Your responsibilities

  • Keep your Google account secure, with two-step verification.
  • Approve only connections you started, to apps you trust.
  • Grant write access to projects only to people who need it.
  • Export data you can’t afford to lose. Auxilian has no self-service restore.

​
Reporting a vulnerability

Email [email protected] with the details and steps to reproduce. Please give us a chance to fix the issue before disclosing it publicly.