Reference

Security & compliance

What happens to your credentials, your payloads and your audit trail.

Encryption#

TLS 1.3 on every hop.
Provider credentials sealed with AES-256-GCM under a per-workspace data key.
Run payloads, node inputs and outputs encrypted at rest, stored separately from secrets.

Private runners#

Workers can run inside your VPC. The control plane then sees run metadata — which node ran, how long it took, what it cost — and never the payload.

Audit trail#

Actor, action, target and a diff for every change: workflow edits, approvals, key rotations, member changes. Retained independently of run history, so a retention policy on runs does not erase the governance record.

Was this page helpful?

Reference

Security & compliance

What happens to your credentials, your payloads and your audit trail.

Encryption#

TLS 1.3 on every hop.
Provider credentials sealed with AES-256-GCM under a per-workspace data key.
Run payloads, node inputs and outputs encrypted at rest, stored separately from secrets.

Private runners#

Workers can run inside your VPC. The control plane then sees run metadata — which node ran, how long it took, what it cost — and never the payload.

Audit trail#

Was this page helpful?