Security Policy
Version 2026.1 · Last updated: 2026-08-24 · Effective: pending approval
ThutaTech services are currently in private beta: public sign-up is closed and no paid plans are on sale yet. Statements about accounts and billing describe how the Services will operate at public launch.
This is a draft pending legal review. It is not the final version and is not legal advice.
This policy is not yet available in your selected language and is shown in English.
SECP-01 — Overview
This page summarizes security practices that are implemented in the ThutaTech Ecosystem today. It intentionally omits internal details that could aid attackers. It is a description of practices, not a certification, and no system is perfectly secure.
SECP-02 — Access control and authentication
User authentication across web products is handled by Clerk, including session management and OAuth sign-in. Administrative functions are role-restricted, and administrative actions in Account Center are recorded in an audit log. Products support scoped API tokens where applicable.
SECP-03 — Secret management
Server-side API credentials are stored in environment configuration, never shipped to the browser. Repositories use secret-scanning checks. In Thuta IDE, your AI keys are stored in the operating-system keychain on your device and are not transmitted to ThutaTech.
SECP-04 — Encryption
All web traffic uses HTTPS/TLS, and our sites set HTTP Strict Transport Security. Encryption at rest depends on the managed database and storage providers we use; provider-level encryption details are being confirmed for the Subprocessors list and are not claimed here until verified.
SECP-05 — Monitoring and logging
Security-relevant events (failed logins, rate-limit hits, admin actions) are logged. Thuta Flow maintains audit logs with a defined retention/archival job. Error monitoring is used in Thuta Studio (Sentry) with the aim of excluding sensitive content from reports.
SECP-06 — Abuse prevention
Rate limiting protects authentication and billing endpoints. Webhooks use signature verification (for example Clerk webhooks via Svix signatures; HMAC verification in Thuta Flow). Credit metering uses reserve/commit semantics to prevent double-spend and to auto-refund failed actions.
SECP-07 — Uploaded files and generated code
Uploaded files are stored in dedicated storage backends and served through controlled paths. Generated application code is treated as user content; it is not executed on our servers except in sandboxed build/preview environments.
SECP-08 — Third-party risk
We rely on established providers for authentication, hosting, databases, payments, and AI processing, listed on the Subprocessors page. We review provider terms and security documentation as part of adding a provider.
SECP-09 — Incident handling
If we become aware of a security incident affecting personal information, we will assess, contain, and notify affected users and the Personal Information Protection Commission as required by the APPI, and other regulators where applicable law requires.
SECP-10 — Vulnerability reporting
Report suspected vulnerabilities to info@thutatech.com. Do not access other users' data or degrade the Services while researching; AUP-03 applies. We will acknowledge reports and act on verified issues.
SECP-11 — Your responsibilities
Keep your credentials secure, use strong unique passwords, protect API tokens and webhook secrets you create, and review approval prompts in agent features before granting them.