Security

Your passwords and keys#

• Tools you sign in to use the tool's own sign-in. Homla never sees your password.
• Keys you paste are encrypted before they are stored, with AES-256-GCM. Each one gets its own encryption key, which is itself protected by a key service.
• A stored key is never shown again, not even to admins.
• People who use a shared account never see its key.
• When you disconnect an account, its stored credentials are removed.

Your AI apps#

• AI apps connect with a browser sign-in. You approve each app by name, and no secret is pasted into the app.
• Each person's AI gets only what their role allows. Read-only actions cannot write, even if the tool would let them.
• Every write is a dry run until confirmed. Agent writes wait for a person unless an admin set them to run on their own.

Sign-in#

• Sign-in links work once, for 10 minutes.
• Sessions end after 30 days, or after 7 days without use.
• Signing out ends the session on our side within 30 seconds. You can sign out of every device at once.
• Two-step sign-in with an authenticator app. Admins need it for admin actions. See Two-step sign-in.
• Sign-up and sign-in are protected against bots.

API keys#

• A key is shown once. Homla stores only a fingerprint of it, not the key.
• Each key has its own access: all, read only, or chosen tools.
• Revoking stops it at once.

Logs#

Every tool call is logged: who or which agent, which action, which tool, the outcome and the time. The content of the call is not stored. Admins see the log in Activity.

Where Homla runs#

The app runs on servers we manage, with data in a managed Postgres database. All traffic uses HTTPS.

What we do not have yet#

• No security certification, like SOC 2 or ISO 27001.
• No recovery codes for two-step sign-in.
• No single sign-on (SAML) yet.

We do not sell your data or use it for ads. Read the privacy policy. Questions: kevin@jollycommerce.io.