Security

Rollout isolates data per workspace, encrypts secrets and Connection credentials at rest, sandboxes workflow code execution, and records sensitive operations in an audit log.

Status: Alpha (features may change).

Authentication

Rollout supports email/password, email magic links, and Google sign-in.

  • Passwords are hashed with Bcrypt and never stored in plain text
  • Magic-link emails expire after 15 minutes
  • Sessions expire after 60 days; remember-me uses a signed cookie
  • Forms are CSRF-protected, and the session is renewed at login to prevent fixation
  • Failed password attempts are rate limited per IP address and per account; successful logins never consume the budget, so users behind a shared network are not locked out
  • Registration and magic-link requests are rate limited too, with the same generic response when throttled
  • Destructive account actions require a recent login and redirect you to re-authenticate when the session is stale

API tokens and devices

The desktop app authorizes through a device flow that issues an API token.

  • Issuing a token requires an explicit confirmation step in the browser
  • Tokens are stored hashed; the original cannot be reconstructed from the database
  • Tokens are valid for one year
  • Review devices, remove them, and control which capabilities they expose to workflows under Resources → Devices

Workspace isolation and sharing

Each workspace is a separate tenant with complete data isolation:

  • Every query is scoped to the workspace at the database level
  • Members hold a role: owner, admin, or member; sensitive settings pages are admin-only
  • Switching workspaces loads an entirely separate dataset
  • Operational resources such as Connections, secrets, and devices are private to their owner until shared with a team or the whole workspace
  • Access checks run inside the database query, so items you cannot access never leave the server

Secret store

Manage workspace secrets under Resources → Secrets.

  • Write-only: a value is set once at creation and can never be viewed again — the list shows names and metadata only
  • Envelope encryption at rest: each secret is encrypted with its own AES-256-GCM data key, and the data key is wrapped by a master key; in the cloud the master key lives in Cloud KMS and never leaves it, while self-hosted deployments supply their own master key through configuration
  • Fail-closed reads: a value that cannot be authenticated and decrypted returns an error, never garbled or partial data
  • A secret can instead reference a 1Password item (op://vault/item/field) when the workspace has a 1Password Connection
  • Secrets follow the private/team/workspace sharing model; workspace admins do not bypass private secrets
  • Every secret action is recorded in the audit log; secret values never appear there

Connections

  • Google Connections use OAuth 2.0 — no passwords are stored
  • Google scopes are granted per Connection: pick only the access a workflow needs (for example Gmail read, Gmail send, Sheets, Drive, or Calendar read)
  • OAuth access tokens refresh automatically
  • Other providers (GitHub, Atlassian, Telegram, SSH hosts, and more) authenticate with API tokens or keys
  • Connection credentials are encrypted at rest with the same envelope scheme as secrets
  • Connections are private to their creator until shared with a team or the workspace
  • Revoke a Connection at any time from Resources → Connections

Webhook security

Incoming webhooks support multiple security options:

  • Unique URLs - Each webhook has a random token in the URL
  • HMAC verification - Validate signatures from services like GitHub or Stripe using an encrypted tenant-secret reference; plaintext HMAC values are rejected
  • Public-key signatures - Providers that sign with an asymmetric key are verified against the public key
  • Timestamp validation - Reject old requests to prevent replay attacks
  • Token rotation - Regenerate webhook URLs if compromised

Code execution sandboxing

  • The Code Execution node runs JavaScript on Deno with default-deny permissions
  • In the cloud, each code step runs in an ephemeral container on gVisor-sandboxed infrastructure
  • Security & governance adds two admin-managed locks: an egress allowlist that restricts runs to listed domains over HTTPS, and a registry allowlist that restricts where workflow images may come from

Audit log

Workspace admins can review the audit log in Settings.

  • Append-only trail covering secret actions, access changes to devices, Connections, storage volumes, and agent identities, and billing events
  • Records hold the actor, action, outcome, and timestamp; secret values are never written to the log
  • Timestamps display in UTC

Web security

  • Content-Security-Policy with a per-request script nonce — inline scripts without the nonce are blocked
  • HTTPS is enforced in production with Strict-Transport-Security (HSTS)
  • Standard hardening headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy

Data retention

  • Workflow runs are archived after 30 days and permanently deleted 90 days after archiving (defaults)
  • Archived workflows appear in Archive and can be restored by an admin within the retention window

Recommendations

Grant minimal scopes Pick only the scopes a Connection needs; create separate Connections for separate scope sets.

Keep credentials in the secret store Store API keys and tokens as secrets instead of pasting them into workflow configuration.

Rotate credentials periodically Regenerate webhook URLs and reconnect OAuth if you suspect a leak.

Separate test and production Use different workspaces for testing to avoid accidental data exposure.

Review access Periodically check Resources → Connections and Resources → Devices, and remove what you no longer use.

Lock down run egress Turn on the egress allowlist in Security & governance when workflows should only reach known domains.

Troubleshooting

Session expired unexpectedly

  • Sessions expire after 60 days; sign in again
  • Clear browser cookies if the problem persists

Too many login attempts

  • Failed password attempts are rate limited per IP and per account
  • Wait about 15 minutes for the window to reset, or sign in with a magic link

OAuth connection failing

  • Try disconnecting and reconnecting the service
  • Verify you granted all requested permissions

Webhook not validating

  • Double-check the HMAC secret matches on both ends
  • Verify the signature header name is correct
  • Check timestamp tolerance if using replay protection