Luffy
Start Free

Your work stays yours.

Security is core to how Luffy operates inside your Slack workspace. We protect your data across infrastructure, access, and every action Luffy takes on your behalf.

Security at a glance

Controls built into every request

  • Encryption in transit and at rest
  • Workspace-level tenant isolation
  • Requester-bound authorization
  • Production access on a need-to-know basis

Current status.

Luffy is CASA Tier 2 certified and approved for the Slack Marketplace, with SOC 2 in progress.

Certified

CASA Tier 2

Our Google Workspace integration is CASA Tier 2 certified.

In progress

SOC 2

SOC 2 audit preparation and evidence collection are underway.

Approved

Slack Marketplace

Luffy has been approved for the Slack Marketplace.

Protection from request to result.

Luffy applies the same core safeguards whether you are asking a question in Slack or authorizing work in a connected tool.

Encrypted in transit

Data moving between Slack, Luffy, and our infrastructure is protected with TLS.

Encrypted at rest

Stored application data and credentials are encrypted while at rest.

Tenant isolation

Each Slack workspace is scoped independently. One workspace's data is never visible to another.

Requester-bound actions

Every action is tied to the Slack user who requested it and their approved access.

A small, vetted provider footprint.

We use a focused set of providers to operate Luffy reliably and securely.

Vercel
Web hosting and deployments
Cloudflare
Edge network, DNS, and site delivery
Modal
Serverless compute for the agent runtime
Neon
Application database (Postgres)
Sentry
Error tracking and reliability monitoring
We do not sell workspace data to third parties.
We do not use Slack conversation data to train large language models.

See our privacy policy for more about data use and retention.

Access is scoped, attributed, and reviewable.

Slack OAuth scopes are limited to the features Luffy actually uses. The full scope list explains why each permission is needed.

  1. 01

    Least-privilege access

    Production access is limited to the engineers who need it, with permissions kept as narrow as possible.

  2. 02

    Identity travels with the request

    Luffy checks the requester and workspace context before it uses an approved tool or takes an action.

  3. 03

    Auditable by design

    Runs retain operational metadata such as request ID, timestamp, status, and tool used for review and troubleshooting.

Found something that does not look right?

If you discover a security issue or vulnerability, let us know. We will acknowledge the report and investigate promptly.

Report a security issue

Still have a question?

We are happy to help with security reviews and product questions.

support@zonko.ai