Security at Luffy

Your work stays yours.

Security is core to how Luffy operates inside your Slack workspace. We protect your data across infrastructure, access, and every action Luffy takes on your behalf.

01 · Data protection

Protection from request to result.

Luffy applies the same core safeguards whether you are asking a question in Slack or authorizing work in a connected tool.

Encrypted in transit

Data moving between Slack, Luffy, and our infrastructure is protected with TLS.

Encrypted at rest

Stored application data and credentials are encrypted while at rest.

Tenant isolation

Each Slack workspace is scoped independently. One workspace's data is never visible to another.

Requester-bound actions

Every action is tied to the Slack user who requested it and their approved access.

02 · Infrastructure and subprocessors

A small, vetted provider footprint.

We use a focused set of providers to operate Luffy reliably and securely.

Vercel
Web hosting and deployments
Cloudflare
Edge network, DNS, and site delivery
Modal
Serverless compute for the agent runtime
Neon
Application database (Postgres)
Sentry
Error tracking and reliability monitoring

We do not sell workspace data to third parties.

We do not use Slack conversation data to train large language models.

See our privacy policy for more about data use and retention.

03 · Access controls

Access is scoped, attributed, and reviewable.

Slack OAuth scopes are limited to the features Luffy actually uses. The full scope list explains why each permission is needed.

  1. 01

    Least-privilege access

    Production access is limited to the engineers who need it, with permissions kept as narrow as possible.

  2. 02

    Identity travels with the request

    Luffy checks the requester and workspace context before it uses an approved tool or takes an action.

  3. 03

    Auditable by design

    Runs retain operational metadata such as request ID, timestamp, status, and tool used for review and troubleshooting.

04 · Compliance

Current status.

Luffy is actively progressing through independent security reviews and compliance readiness work.

In progress

SOC 2

SOC 2 audit preparation and evidence collection are underway.

In progress

CASA Tier 2

CASA Tier 2 assessment of our Google Workspace integration is underway.

In progress

Slack App Directory

Slack's app directory review is underway.

05 · Incident response

Found something that does not look right?

If you discover a security issue or vulnerability, let us know. We will acknowledge the report and investigate promptly.

Report a security issue

Still have a question?

We are happy to help with security reviews and product questions.

support@zonko.ai