Security, with the
trust boundaries shown.

Glueprint uses a tenant Data Encryption Key (DEK) for relay content. Password, recovery, and agent-host paths store and transport only wrapped key material. Enterprise SSO stores a second KMS-wrapped key and permits the relay to call AWS KMS Decrypt for an authenticated SSO session.

The desktop keeps its active DEK in zeroizing process memory and clears it when the encryption manager locks. The portal may keep exportable key bytes in tab-scoped session storage until logout or the browser session ends. Device compromise can expose plaintext or key material available on that endpoint.

Content encryption narrows plaintext exposure, but the exact relay boundary depends on the authentication path. It is not a promise that every field is opaque, and it is not a substitute for endpoint security or intra-organization access control.

Human and agent connections use separate credential types and scopes. Desktop sign-in uses PKCE, human relay clients use JWTs, and agent hosts authenticate with API keys.

Server-side authorization evaluates organization role, host visibility, team membership, board role, and object ownership before data or control requests are accepted. Sensitive WebSocket controls pass through explicit subtype allowlists and role gates.

• Team mutations remain server-authoritative, including lead and tenant-admin checks.
• Board actions distinguish viewer, contributor, and lead permissions.
• Assistant governance adds permission tiers, tool filters, budgets, quiet hours, and supervision rules.
• Task Flow Definitions restrict state transitions by role.
• Audit events record security-sensitive account, team, task, and administrative activity.

Repositories, agent processes, terminals, and the primary operational store remain on the selected host. Desktop and daemon data default to ~/.glueprint/, with YAML and JSONL files for configuration and event history.

Rust services expose typed command boundaries to the desktop frontend, and shared storage paths use atomic-write patterns where implemented. Tokens, API keys, and managed harness keys use dedicated local files rather than universal OS-keychain storage; Unix writes use owner-only permissions. Endpoint account controls, filesystem permissions, and disk protection remain part of the security boundary.

Authenticated HTTP and WebSocket connections carry control and encrypted event traffic. Sequence tracking and gap fill support ordered delivery and recovery; they are delivery controls rather than a replacement for cryptographic authentication.

• Control-plane and data-plane roles separate account/billing operations from relay traffic.
• Every tenant is pinned to a cluster, and mismatched HTTP or WebSocket connections are rejected with a re-home target.
• Rate limits and heartbeat monitoring reduce abuse and stale connections.
• PostgreSQL stores durable service state; Redis supports presence, routing, and short-lived buffers.
• Typed control messages, structured errors, and explicit allowlists narrow the remote-command surface.

Glueprint does not claim a certification, penetration-test result, or security property that has not been independently established.

We welcome responsible reports. Send a private description, potential impact, reproduction steps, affected version or surface, and relevant proof-of-concept material to security@glueprint.ai. Please avoid accessing data that is not yours or disrupting other users.

We will acknowledge and assess reports as promptly as practical, coordinate remediation, and ask that you allow reasonable time before public disclosure. If an incident affects personal data, we will investigate, contain it, and notify affected people and authorities as required by applicable law.