Security
Provider tokens
OAuth provider tokens are encrypted at rest, removed locally on disconnect, and revoked at the provider on a best-effort basis; key rotation is a remaining roadmap gap.
How tokens are handled
OAuth tokens are encrypted at rest in production and never shown, logged or placed in the audit trail. Disconnecting an account removes the stored token locally; revoking at the provider is attempted on a best-effort basis.
Honest gap: automated key rotation for token encryption is not yet implemented and remains on the roadmap.
Frequently asked questions
- Is key rotation implemented?
- Not yet — encryption at rest is in place, but automated key rotation is a remaining roadmap gap.