Security at Guyche
Security is not a marketing claim or an assumed certification. This page describes controls present in the current architecture and avoids claiming audits or standards that have not been established.
Identity and access
Dashboard routes require a valid session. APIs enforce role-based access, and administrator sessions use HttpOnly, strict SameSite cookies, revocation, and optional two-factor authentication.
Data and secret protection
Provider keys and administrative secrets remain server-side, and configured secrets use an administrative encryption key. Secrets must not be placed in public content or client code.
Web-layer controls
Content Security Policy, frame restrictions, Referrer Policy, origin checks for sensitive mutations, and rate limiting for selected paths form part of the web defense.
Customer responsibility
Workspace administrators must manage member access, approved knowledge, deletion cycles, and widget domains according to their organization policy.