Security
What we do today, and what we haven't done yet.
In place
Controls in the product today
Passwords hashed with scrypt
Per-user salts; plaintext passwords are never stored or logged.
Sessions in httpOnly cookies
Opaque random tokens; only their SHA-256 hash is stored server-side.
Scoped, revocable API keys
Keys are shown once, stored as SHA-256 hashes, limited to the scopes you grant and revocable instantly.
Expert identities protected
Buyers see work under per-project pseudonyms, never names or emails.
Minimal work telemetry
Active time, focus changes and paste counts only — never keystroke content, screenshots or webcam.
Hidden environment state
Agents receive tool observations only; verifiers alone read the full state.
Audit log
Sign-ins, project changes, reviews and payouts are recorded with actor and time.
Rate limiting
Public endpoints, sign-in and sign-up are rate-limited per client.
No public links to work
Datasets and episodes are only reachable by authenticated members of the owning workspace.
Roadmap
Not done yet — and stated as such
SOC 2 Type I, then Type II
Readiness work is planned; we are not certified today.
ISO 27001
Planned after SOC 2.
SSO (SAML / OIDC) and SCIM
Planned for workspace sign-in and provisioning.
Contractor identity checks with liveness
Third-party verification at expert onboarding, with payee-name matching.
Private deployments
Twins and data pipelines inside your cloud account.
Independent penetration test
Before the first production customer engagement.
Report a vulnerability: security@sandworld.dev