Security
Ray handles sensitive conversations, so protecting them is built into how it works. Here’s how we keep your data and accounts safe.
Your data
Separate workspaces
Every organisation gets its own workspace. Each request is tied to one workspace, and data from one is never returned to another.
Secrets encrypted at rest
Credentials you connect, such as your chat provider’s API secret, are encrypted with AES-GCM before they’re stored, and are never sent back to the browser.
Hosted on Google Cloud
Ray runs on Google Cloud. Its own keys and credentials are held in Google Secret Manager, not in code.
Accounts and access
Passwords are never stored
We keep only a salted, slow hash of your password (PBKDF2), so it can’t be read back, even by us.
Secure sessions
Signing in sets HttpOnly cookies that scripts on the page can’t read. Access tokens are short-lived, and each refresh token works only once.
Protection against forged requests
Every change made from the dashboard needs a separate CSRF token, which a malicious site can’t get.
API keys shown once
Developer API keys are displayed a single time when created. We store only a SHA-256 hash, and you can revoke a key at any time.
Questions
Need more detail for a security review? Get in touch.