Security
Last updated: August 23, 2026
Security is built into how KODA runs agents, stores data, and connects to models. This page summarizes our practices — not an exhaustive contract.
Overview
KODA uses encrypted transport (TLS), authenticated APIs, role checks on protected routes, rate limiting on public endpoints, and sanitized HTML where user content is rendered.
Authentication & access
Sign-in via Supabase Auth (OAuth and email). Session refresh runs at the edge before SSR on protected routes. Service-role keys never ship to the browser. Admin access is limited to configured allowlists.
Data protection
Production data lives in managed PostgreSQL with row-level security on exposed tables. Secrets stay in server environment variables. Client bundles only receive `NEXT_PUBLIC_*` values.
AI safety controls
You choose models and approve agent actions. Premium models require sufficient credits and plan entitlements. Usage is metered per request. We recommend reviewing diffs and running tests before merge — similar to automated code review workflows.
Infrastructure
Hosting on Netlify with CDN, isolated serverless functions for APIs, and Redis for cache/rate limits where configured. Dependencies are patched via `patch-package` and monitored for known vulnerabilities.
Incident response
We investigate security reports promptly, contain impact, notify affected users when legally required, and document remediation steps.
Responsible disclosure
Report vulnerabilities to security@affinify.com. Include steps to reproduce and impact. Do not access data that is not yours. We appreciate coordinated disclosure and will acknowledge valid reports.
Enterprise
Teams and Enterprise customers may request additional controls (SSO, audit logs, DPA). Contact sales@affinify.com.