Security

Akagi holds what teams know about their work, so we treat its protection as part of the product. This page says what we do, in plain words. The Privacy Policy says how information is handled, and the sub-processors list names the companies that help us run Akagi.

Where your information is kept

Akagi runs in Google Cloud's Sydney region. The database, file storage, logs and background jobs are there, and backups are kept in Australia (a second region, Melbourne).

Encryption

• In transit: connections to Akagi use HTTPS (TLS 1.2 or later), and browsers are told always to use it. Connections between Akagi's services and its database are encrypted.
• At rest: Google Cloud encrypts the database, backups, file storage, secrets and logs.
• Sign-in codes: sessions, renewal codes and similar codes are stored only as one-way hashes. The key that signs the passes your AI apps use is held in Google Cloud's key management service.

Who can see what

• Workspace isolation: every workspace's records are separated inside the database itself, so one workspace's requests cannot read another's.
• Checked on every request: membership, roles, private folders and AI app permissions are checked each time. Removing access takes effect within seconds.
• Private folders and files stay hidden from people without access, wherever Akagi shows information.
• Least privilege: each part of Akagi runs with only the cloud permissions it needs, and secrets are kept in Google Cloud's Secret Manager.

Files and AI

• Uploaded files are checked and scanned for malware, and are never run.
• Teammates' text is shown to AI apps as quoted information, never as instructions.
• Actions that delete things or widen access need a person's explicit confirmation.
• Akagi's handoff notes use session activity only, never the files themselves.

Records, limits and watching

• Audit records of access changes cannot be altered by the application.
• Logs are written without secrets: tokens, links and file contents are kept out of them.
• Limits and a web application firewall stand in front of Akagi, to slow down abuse and bulk copying.
• Monitoring and alerts watch for faults and suspicious activity.
• Backups are kept in Australia, and we practise restoring them.

Deleting information

Deleted accounts, projects and workspaces disappear from view at once, and are removed from live systems within the time the Privacy Policy gives, and from backups after that.

Reporting a vulnerability

If you find a security problem in Akagi, please tell us at security@akagi.work. Give us a reasonable time to fix it before you share it, and do not read, change or delete other people's information while you look. We will acknowledge your report and keep you informed.

No system is perfectly secure. We work to keep these measures current and to fix problems quickly. If something goes wrong that affects your information, the Privacy Policy says how we will tell you.