Security & Trust Center
Megapodes is built for systems of record. Security is not a feature layered on top — it is the structure of the platform: validated configuration instead of generated code, database-enforced authorization, and a human approval gate on every structural change.
Safety is structural, not procedural
The AI emits validated configuration — never executable code — so it cannot inject arbitrary logic. Every proposal is schema-checked and dry-run before you approve it.
Configuration, never code
An application is schema-validated declarative metadata — collections, fields, relations, pages, workflows, permissions — interpreted by a fixed, hand-built, tested runtime. There is no path from a model's output to executable code, so the attack surface of "AI-written software" does not exist here.
Universal mutation-safety gate
Every structural mutation — AI-proposed or manual — passes the same pipeline: Zod schema validation → business-rule validation → migration dry-run → human approval → transactional apply → append-only audit log. Destructive changes are individually confirmed with the affected data named.
Three enforced layers, fail-closed
Authorization is enforced server-side and in the database itself. If any layer denies, the request fails closed with a 403 — there is no fail-open path.
Layer 1 — Role ACL
Roles map to permissions over resources, actions, fields, and data scope. Denied actions never reach the data layer.
Layer 2 — PostgreSQL RLS
Row-Level Security is forced on every tenant table. The application database role can never hold BYPASSRLS — even a compromised application server cannot read rows the policy denies.
Layer 3 — Field-level masking
Field permissions are applied in the SQL query itself, not filtered afterwards in application code. Masked fields never leave the database.
The AI security boundary
Two AI planes, one hard boundary — enforced server-side and tested adversarially.
Build plane vs runtime plane
The build-time agent creates and modifies structure — always behind the approval gate. Runtime AI Employees operate on data only, bound to the invoking user's role. Neither plane can assume the other's powers.
Prompt-injection defenses
Retrieved knowledge-base content is treated as untrusted context: it can inform proposals but can never authorize a mutation, escalate a tool, or bypass the approval gate. These properties are tested adversarially, not assumed.
AI Employees denied the build surface
Runtime AI Employees are hard-denied every build-surface capability server-side. No prompt, workflow, or document can grant an AI Employee the ability to alter application structure.
Encryption and credential hygiene
In transit and at rest
TLS with HSTS on every connection; data encrypted at rest. Sensitive downloads use presigned, short-TTL URLs rather than long-lived links.
Envelope-encrypted credentials
External data-source credentials are encrypted with a per-source data key wrapped by a KMS-managed key encryption key. They are never persisted in plaintext and never logged.
Identity and outbound guards
Passwords hashed with argon2id; refresh tokens stored hashed; short-lived rotating JWTs. REST data sources carry SSRF guards with outbound allow-lists and timeouts.
Tenancy
Schema-per-app isolation
Isolated by schema
Each application lives in its own PostgreSQL schema. There are no shared tenant tables to mis-filter — isolation is a property of the database layout, not of query discipline.
Per-app backup and restore
Backups and restores are scoped to a single application, so one app's recovery never touches another's data.
Verifiable erasure
GDPR-style erasure is a per-app schema drop — complete, verifiable removal rather than soft-delete flags scattered across shared tables.
Audit and observability
Append-only audit log
Every gated mutation and every AI action is recorded in an append-only
audit_log with actor_type of
human, ai_build, or
ai_employee — so reviewers can always answer who or
what changed the system, when, and with whose approval.
OpenTelemetry
Traces, metrics, and logs are exported via OpenTelemetry, so Megapodes plugs into the observability stack your security operations team already runs.
Supply-chain security
Locked dependencies
Dependencies are pinned via lockfile; builds are reproducible from locked versions.
Minimum release age
New package versions must age before adoption, reducing exposure to freshly published malicious releases.
Native-build allow-list
Packages that run native build scripts are restricted to an explicit allow-list.
SBOM & CI audit
A software bill of materials is produced at build time,
and pnpm audit runs in CI on every change.
AI that stays inside your network and inside its lane
Local-only inference
All inference runs on a local LLM via Ollama, on your hardware. AI features fail closed: if the local model is unavailable, AI-assisted operations stop and report why, while the running application continues under normal manual operation. There is no cloud fallback and no silent degradation. Prompts and data never leave your network.
Human oversight by design
Every structural change is previewed, human-approved, and logged with its actor type. This human-oversight and traceability posture maps directly onto EU AI Act readiness expectations for organizations deploying AI in business-critical systems.
Engineered for regulated environments
Megapodes is engineered for regulated environments. The platform’s controls are designed in alignment with ISO 27001 (information security management), GDPR and India’s DPDP Act 2023 (data protection), SOX ITGC (change management, access control, and audit-trail requirements), and SOC 2-style trust criteria. Certification programs are on our roadmap; our architecture documentation, control mappings, and security questionnaire responses are available to customers under NDA.
Approval Gates & Audit Log
Approval gates on every structural mutation with append-only audit_log and actor tracking.
Three-Layer Authorization
Role ACL → Forced PostgreSQL RLS → Field-level SQL masking.
Schema Isolation & Local AI
Schema-per-app erasure and local AI processing ensure data never leaves your infrastructure.
Encryption Everywhere
Envelope encryption, KMS-managed keys, TLS with HSTS, and encryption at rest.
Supporting your compliance program
We never claim certification on your behalf. Megapodes is built with these frameworks in mind and supports customers' own compliance programs. Because the platform is self-hosted, your existing controls, certifications, and residency commitments apply directly to your deployment.
Vulnerability disclosure
We accept vulnerability reports at security@megapodes.com. Reports are acknowledged, triaged, and tracked to resolution. The platform undergoes internal adversarial testing today, while independent security assessments remain part of our certification roadmap. Architecture documentation and control mappings are available under NDA.
Security review support
We support your security review with architecture documentation, data-flow diagrams, control mappings, and questionnaire responses under NDA. Request our security documentation package →
Put the security model in front of your reviewers
Walk through the approval gate, the RLS enforcement, and the audit trail live — or start with the documentation package.
Self-hosted — your data never leaves your network · Every change human-approved and audit-logged · SSO/OIDC available · We support your security review.
The governed AI application platform. A local AI builds business systems as validated configuration, every change is human-approved, and it all runs on your infrastructure.