An AI agent driving your product should be the easiest thing in your security review.

Tenant isolation

One workspace per company

Dashboard users belong to explicit workspaces. Sessions, workflow runs, events, transcripts, and issues carry the workspace ID, with composite database constraints preventing cross-workspace relationships.

The server decides which workspace you are in

Dashboard routes require both a signed-in user and an active membership for the workspace in the route. Permission checks happen before session data is loaded.

Public access is capability-scoped

The publishable key can request a demo, but a separate random session capability is required to read, control, complete, or request a LiveKit token for that session.

Authentication and access control

Provisioned dashboard accounts

Dashboard accounts are provisioned by an operator; there is no public dashboard signup. Password verification uses a salted bcrypt hash over a SHA-256 prehash.

Opaque server-side sessions

Successful sign-in returns a random opaque session token. Only its SHA-256 hash is stored, and the dashboard keeps the token in an HttpOnly, SameSite cookie.

Roles enforced server side

Owner, admin, analyst, and viewer permissions are defined in one server-side matrix. Session, transcript, event, issue, analytics, member, export, and tenant permissions are evaluated by the API.

Sessions

Work-email admission

The public demo requires a normalized work email and rejects known consumer and disposable domains. This is an abuse heuristic, not proof of employment or mailbox ownership.

Server-verified human challenge

Cloudflare Turnstile is verified by the Go API before a session is created. Tokens are never logged or stored, and provider failures fail closed.

Private attendee identity

The attendee email is available to authorized dashboard users, but is omitted from visitor session responses and LiveKit participant metadata.

Reviewable records without recording

Finalized transcript turns, workflow events, issue signals, and session timing are durable. Audio and screen recordings are not captured in this phase.

What the agent is allowed to do

No live product control

A session can only change screens, point, scroll, and annotate inside an immutable published capture. It cannot operate your live product or change data, because it is never connected to one.

Sandboxed local replay

The buyer renders sanitized compiled snapshots in a sandbox with network access disabled. Raw capture events are not published to buyers.

No product credentials anywhere

Capture runs in your own already-authenticated browser. There is no sign-in feature, no credential vault, and no product session to hand to a model, so there is nothing of yours for us to lose.

Reviewable before a buyer sees it

Prepared flows, approved answers, and guardrails are configuration your team can read and sign off, rather than behaviour you discover in production.

Session observability

Ordered transcript and events

Finalized visitor and agent turns are stored in sequence. Workflow events retain their source sequence, emitted time, type, step, and payload.

Automatic review signals

Workflow failures, failed steps, verification failures, failed detours, and missing browser targets create tenant-scoped issues for dashboard review.

Operator audit is separate

A dedicated log for sign-ins, sensitive reads, role changes, exports, and issue decisions is not enabled yet and is listed below as launch follow-up work.

Data handling

What we store

The demo stores its configuration, published capture data, workspace membership, attendee work email, finalized transcript, workflow events, and detected issues.

Recording is off

Audio and screen video are not retained. The dashboard marks recording as unavailable rather than implying that media exists.

Retention must be configured

The MVP schema supports tenant-scoped deletion, but a production retention window, export process, and attendee deletion workflow still need to be chosen before broad launch.

Not yet built

We would rather you find this here than in a questionnaire. If one of these blocks a deal, tell us and it moves up.

• OIDC or SAML single sign-on and SCIM directory provisioning
• Dashboard invitations, membership management, and session revocation controls
• An append-only operator audit log and controlled CSV exports
• Verified work-email ownership through a magic link when stronger identity is required
• Configurable retention, attendee deletion, and export workflows
• Authenticator-app two-factor for password accounts
• Customer-managed encryption keys and configurable data residency
• SOC 2 Type II. We are not certified today, and we will not claim otherwise

Reporting a vulnerability

Email hello@trysparrow.ai with steps to reproduce. We acknowledge within one business day and will keep you updated until it is closed. Please do not test against another customer's workspace.