---
title: "Security at OXOM"
description: "How OXOM separates workspaces, protects data and handles security reports. Controls, subprocessors and how to report."
canonical: https://oxom.de/security
last-updated: 2026-10-10
---

# Security at OXOM

> How OXOM separates workspaces, protects data and handles security reports. Controls, subprocessors and how to report.

Canonical HTML: https://oxom.de/security
## The essentials
- **Separate workspaces** — every data query is bound in code to exactly one workspace; row-level security in the database is a second layer behind that.
- **Encryption** — TLS on every connection, encryption at rest by the providers; integration credentials are additionally encrypted by OXOM itself with AES-256-GCM.
- **Sign-in and roles** — sign-in via Clerk, permissions via roles per workspace; agents connect with OAuth 2.0 and PKCE, with membership and role re-checked on every call.
- **Audit logs** — key actions on members, domains, files, offers and by the agent are logged and kept for one year.
- **Abuse protection** — rate limits (via Upstash) on sensitive endpoints; IP addresses are only stored as a hash that changes daily.
- **In progress** — the Content Security Policy still runs in report-only mode; a hard confirmation gate before consequential agent actions is in progress.

## AI agent
If a workspace's configuration cannot be loaded, the agent only gets read-only tools. Every action with outside effect lands in the audit log, and custom MCP servers are checked against access to internal addresses (SSRF). The agent uses Claude from Anthropic via the API; Anthropic does not use API data for training by default.

## Subprocessors
External providers in day-to-day operation include: Vercel (hosting), Supabase (database), Clerk (sign-in), Cloudflare (file storage R2, in the EU), Stripe (payments), Anthropic (AI agent), Liveblocks (Docs), Upstash (rate limiting), Resend (email), Sentry (error analysis) and Railway (bots). Integrations like Twitch or Buffer only come into play when a workspace connects them. The full list is at https://oxom.de/security

## Advisories
- **OXOM-2026-001** (high, reported and fixed on 3 May 2026) — an internal database function for decrypting stored API credentials was reachable through the REST API without authentication. Access has since been restricted to the server; there was no indication of unauthorised access.

## Report a vulnerability
Reports go to security@oxom.de — the affected address, reproduction steps and the possible impact help. First response within 72 hours; fixes by severity (critical: first mitigation within 72 hours, high: 7 days, medium: 30 days, low: 90 days). Good-faith testers who stay legal, break nothing and look at no more data than necessary need not fear legal action. There is no paid bug bounty programme and currently no enterprise SSO (SAML).

Machine-readable: https://oxom.de/.well-known/security.txt

## Read more
- [Safety — recognising real OXOM communication](https://oxom.de/safety)
- [Privacy policy](https://oxom.de/privacy)
- [Contact](https://oxom.de/contact)
- [Status](https://status.oxom.de)