Security at StackTether
StackTether is built security first: every user signs in with 2FA, each business's data is isolated in the database, vendor credentials live in an encrypted vault, every tool is read-only, and every AI tool call is audited without storing record content. This page explains the controls, what we have not done yet, and how to report a problem.
Where we stand today. StackTether has passed internal code reviews, a code scan and automated web vulnerability scans (baseline and active). It does not hold a SOC 2 report or a HIPAA certification, and an independent third-party penetration test is planned, not yet done. We will publish an update here when it is.
Accounts and sign-in
- Invite-only. Accounts are created only from an invite by an admin of the MSP; sign-ups without one are refused. Invite codes are stored only as one-way hashes.
- 2FA for everyone. Every user enrols an authenticator app (TOTP). The database itself refuses tenant data to sessions without a verified second factor.
- Step-up 2FA. A fresh code is needed for sensitive actions such as handing over the primary admin role, resuming paused AI access or deleting a tenant.
- Lockouts and limits. Wrong passwords lock the account for longer each time (5 tries: 1 minute, 10: 5 minutes, 15: locked until reset). Sign-in and 2FA are rate limited, and a bot check protects the sign-in forms.
- Sessions tied to their network. A portal session that suddenly comes from a different network is signed out.
Tenant isolation
Every table that holds a business's data has Postgres Row Level Security with a policy scoped to the signed-in user's tenant, plus a second policy that requires a 2FA-verified, live session. The tenant always comes from the verified login, never from anything an AI app or browser sends. Automated database tests prove that one tenant cannot read another tenant's rows, and they run on every change. Our server also signs every database request with a server key, so a stolen user token used directly against the database gets nothing.
Vendor credentials
- Saved only after a passing connection test, into an encrypted vault.
- Never shown again after saving (the portal shows a fixed mask), never logged, never returned to an AI app.
- Read by one function only, at the moment a tool needs them, and only for members an admin granted access to that connection.
- We recommend a dedicated read-only API user for every vendor; the support guides show how.
AI app connections
- AI apps connect with OAuth 2.1 and PKCE. The approval page needs a 2FA sign-in and names the app.
- Only apps on our approved list are accepted, and only once an admin has switched them on for the MSP. Admins can also allow or block apps per person.
- Access tokens are checked on every call (signature, issuer, audience, age) and live 15 minutes. Approvals last 30 days for cloud apps and 7 days for apps on a tech's computer, and end after 14 idle days.
- Calls for Claude must come from Anthropic's published network range. Apps on a tech's computer can be limited to a list of countries, with temporary travel overrides.
- Call budgets per tech and per MSP, an unusual-activity guard that can pause a tech until an admin reviews, and kill switches for the MSP and the whole platform.
- Signing a member out everywhere, resetting their password or 2FA, or pausing them revokes all their AI approvals at once.
What the AI can and cannot see
Every tool is read-only, and a written data policy decides which vendor fields a tool may return. These are never mapped into any tool: passwords, secrets, tokens, API and licence keys, credentials stored on assets or contacts, Social Security and tax numbers, dates of birth, bank and card numbers, salaries, prices, costs, rates, billing and invoice amounts, and home addresses. Long text is shortened. Vendor text is passed to the AI between clear markers and labelled as data, not instructions, so text inside a ticket cannot pose as StackTether. Error messages are fixed text we wrote and never include vendor text, addresses or secrets.
MSPs that serve medical or dental clients should assume tickets may contain patient information. StackTether keeps none of that content, but the AI app you use will receive the answers, so choose an AI plan that meets your obligations.
Audit and logging
Every AI tool call, including refused calls, gets exactly one audit entry: tool, tenant, user, AI app, time, network address, outcome and record IDs. Never content. If the entry cannot be written, the answer is withheld. Admin actions, platform staff actions, sign-in events and failed token checks have their own logs. Unexpected errors are logged by type and location only.
Hosting and encryption
- Application: Vercel, US East (Washington, D.C. area).
- Database, sign-in and vault: Supabase, US East (North Virginia).
- All traffic uses HTTPS with HSTS. Strict security headers and a content security policy on every page. This website runs no JavaScript except the bot check on the contact form, and uses no tracking cookies.
- Data at rest is encrypted by the hosting providers; vendor credentials are additionally encrypted in Supabase Vault.
The full list of service providers is on the subprocessors page.
Data retention
| Data | Kept for |
|---|---|
| Audit log, team and platform logs, sign-in events, failed token checks | 1 year |
| Sign-in accounts not linked to any MSP or open invite | 30 days, then deleted |
| Closed invites (accepted, revoked or expired) | 90 days |
| A deleted MSP's data | Purged after a 30-day undo window |
| Safeguard hits and known networks | 90 days |
| 2FA attempts and lockouts | 2 days |
| Sign-in counters and call budgets | 1 day |
| Record content from your vendor systems | Not stored |
Known limits we accept for now
We would rather tell you than have you find out:
- No independent penetration test yet (planned), no SOC 2 report and no HIPAA certification.
- The portal's content security policy allows inline scripts because of a framework limit; other protections (escaped output, no third-party scripts, strict connection rules, httpOnly cookies) compensate.
- Some extra sign-in hooks from our authentication provider need a higher plan; until then, our own lockouts and the provider's per-network limits apply.
- Anyone who can trick a tech into approving an AI app could use that tech's access. Short approvals, named consent, per-person app controls, the activity guard and the audit log limit the damage.
Report a security issue
If you think you have found a vulnerability, please send a security report. Describe what you found and how to reproduce it, but do not include live secrets or real client data, and do not access other people's data. We read every report and reply. A machine-readable contact is published at /.well-known/security.txt.
Security questions
- Is StackTether HIPAA compliant?
- StackTether does not claim HIPAA certification and does not store record content from your systems. If your clients' tickets may contain patient information, talk to us before you connect and review your AI app's own terms.
- Can StackTether staff see my tickets?
- No. Tickets are read from your PSA only when a tool is called for one of your members, and are not stored. Platform staff manage tenants and accounts but have no tool to read your vendor data.
- What happens to my data if I leave?
- An MSP's data is deleted 30 days after the MSP is scheduled for deletion; the delay lets you undo a mistake. Remove StackTether's API users in your vendor systems as well.