Security

In transit — All traffic between your application and the SoulHoster API is encrypted with TLS 1.2 or higher. We do not support unencrypted HTTP connections.

At rest — All stored data, including agent configurations, conversation history, and API credentials, is encrypted at rest.

API keys — Tenant API keys are never stored in plaintext. We store a one-way SHA-256 hash and a non-secret prefix. If you lose a key, it cannot be recovered — only revoked and replaced.

BYOK credentials — If you supply your own AI provider API key, it is stored encrypted at rest and decrypted only in memory at the time of use. It is never logged or exposed through our API.

Each tenant is logically isolated. One tenant's agents, keys, and conversation data cannot be accessed by another tenant. Isolation is enforced at the data layer — not just at the application layer — so a bug in one tenant's agent cannot read or write another tenant's data.

Agent execution environments are ephemeral: they start fresh per request and do not share memory or filesystem state with other agents or tenants.

API keys — All API requests must include a valid tenant API key in the Authorization header. Keys are scoped to a single tenant and carry no cross-tenant permissions.

Key rotation — You can generate and revoke API keys at any time from the admin dashboard. We recommend rotating keys periodically and immediately after any suspected compromise.

Rate limiting — Requests are rate-limited per tenant and per agent to protect against credential misuse and abuse.

Agent content — System prompts and conversation data are stored solely to operate the Service. We do not use your agent content to train models or for any purpose other than serving your API requests.

Retention — Agent content is deleted within 30 days of agent deletion. Usage logs are retained for 90 days. You can request earlier deletion at any time.

No selling — We do not sell, rent, or share your data with third parties for commercial purposes.