Security
Built for the person who can say no.
How Studio checks membership, what it seals, what it leaves to people, and what it caps and writes down. Each point comes from the product's code; none is a certification.
01
Membership is checked
Every request checks that the person signed in is a member of the workspace.
- Members sign in with a link sent to their work email. That sign-in link works once and expires after 15 minutes.
02
Credentials stay sealed
The publishing tokens and model keys you connect are encrypted at rest, used only on the server, and shown back as their last four characters.
- The tokens, app passwords and API keys you connect are encrypted at rest with AES-256-GCM under a server-side secret, and decrypted only on the server, at the moment they are used.
- What a screen reads back is whether a key is set, its last four characters, and when it changed. The key itself is not part of that, so it does not reach the browser.
- Destination settings accept only their own named fields, and tokens are stored only in the encrypted store.
- Keys for outside agents are stored hashed, so a copy of the database is not a set of working keys.
03
Roles decide who approves
Only someone with the approver role can approve an article, and agents connected over MCP get no key that can approve, schedule or publish.
- An article goes out only after someone with the approver role approves it, and a failing check has to be resolved first.
- Agents research and draft. They cannot schedule or publish until a person approves. Only an admin sets what agents may do.
- Agents you run elsewhere connect over MCP with a key you scope. No scope can approve, generate, schedule or publish, and a revoked key keeps its name on everything it did.
04
Spending has a ceiling
Each workspace has a monthly model budget. When it is spent, the work stops and says so, instead of running up a bill.
- Every model call is metered to its workspace, and a call an agent makes is also tied to its run and its agent.
- When the month's budget is spent, Studio stops writing, and each campaign with unfinished work reads At risk and says that is why.
05
Everything is on the record
Runs, decisions and outcomes are written down as they happen, and a correction is a new row rather than an edit.
- Every agent run records when and why it ran and what it wrote, and each model call it makes is metered to that run.
- A decision's changes apply once. A change is applied only against the value it was formed from, so one whose work has moved on is recorded as not applied instead of overwriting the newer work.
- Outcomes form an append-only ledger. A correction is a new row, an attested outcome is always labeled attested, and only an owner or an admin can redact an attested statement, which is itself recorded.
This page makes no compliance claim: no certification, attestation or audit is described here.