Trust
Security
This page is informational. It is not part of the Terms of Service.
An honest trust page
This page describes Candler’s current security architecture. It is not a contract, not a certification, and not a promise of absolute safety. Candler does not currently claim SOC 2, ISO 27001, or similar attestations, and does not describe its cryptography as “military-grade.”
Encrypted Vault, Authenticator, and Recovery
Vault secret values, Authenticator TOTP seeds, and stored Recovery payloads are encrypted with AES-256-GCM. Ciphertext, IV, authentication tag, and key version are stored. There is no plaintext value column on Vault secrets. Encryption keys are server-side secrets, not browser secrets.
Authorized reveal decrypts on the server for the signed-in owner after workspace and ownership checks. Sensitive reveals can require step-up authentication. Decrypted values may exist briefly in memory during that operation.
Tenant isolation and Cloud access
Application data is isolated with Postgres row-level security so one authenticated user cannot read another user’s workspace rows through the normal API. Cloud objects live in private R2 storage, addressed with owner-scoped keys, and are accessed with short-lived signed URLs rather than a public bucket.
Cloud quotas are enforced on the server. Authenticated clients cannot mark objects backed up or write Cloud rows in ways the product does not authorize.
Agent isolation
Candler Agent is built to work from metadata and sanitized text. Known secret patterns are redacted before model calls, and tool payloads are rejected if they still look like raw secrets. This is a boundary, not a proof that no secret can ever appear in a prompt you type yourself.
Audit and logging
Security-relevant actions can write audit events (for example, that a secret was copied). Those events record metadata such as actor, workspace, and event type. They are not designed to store the secret, TOTP code, or password. Obvious sensitive fields are redacted before insert.
Limits
Candler cannot protect a compromised laptop, reused password, or phishing site that impersonates us. Backups can fail. Processors can have incidents. You should use unique passwords, keep recovery codes offline, and keep independent copies of irreplaceable work.
Contact
Security reports: legal@candler.dev or hello@candler.dev. Please do not include live production secrets in the initial email.