KeystoneIQ Security Overview

This document provides security information for vendor reviews and compliance inquiries. KeystoneIQ is the product; Intellibricks Inc. is the operating company.

AI Data Handling

• Data is transmitted to AI providers via encrypted connections for brief generation only.
• Under API terms with our providers, customer content is not used for model training.
• We do not store prompt/completion logs beyond what is needed to deliver the Service.

Data Protection

• Encryption in transit: All traffic uses TLS (HTTPS).
• Encryption at rest: Integration credentials are encrypted at rest. Database encryption follows our hosting provider's standards.
• Keys and tokens are never logged.

Access Controls

• Authentication: Email/password, Google, Microsoft sign-in. Enterprise SSO (SAML) coming soon.
• Two-factor authentication: TOTP-based MFA available for all users.
• Role-based access: Owners manage workspace settings, billing, and team. Members can view and interact with intelligence.
• Data isolation: All data is scoped to your workspace. Multi-tenant isolation ensures no cross-workspace data access.
• API keys: Owner-only creation and revocation. Scoped per workspace. Never logged.

Audit Logging

Sensitive operations are logged for compliance review, including API requests, authentication events, and administrative actions. Logs are append-only with no credentials stored.

Rate Limiting

API endpoints are rate-limited to prevent abuse. Sensitive operations have stricter limits.

Data Retention

• User data retained while workspace is active.
• Export and deletion available from account settings, supporting GDPR right to erasure.

Incident Response

• Report: support@keystoneiq.ai
• Process: Containment, investigation, notification to affected customers without undue delay per applicable law (including GDPR Art 33/34 where applicable).

Compliance

• GDPR: Export and delete capabilities; data processing aligned with controller obligations. DPA available upon request.
• PIPEDA: Accountable under Canadian federal privacy law.
• CCPA/CPRA: We do not sell personal information.

Infrastructure

• Application and data processing run on managed cloud infrastructure in the United States with encryption in transit and at rest.
• Database backups are managed by our hosting provider.
• Infrastructure providers maintain industry-standard security certifications.
• KeystoneIQ is responsible for application-level controls: access management, audit logging, credential encryption, and incident response.

Integration Data Access

When you connect an integration, KeystoneIQ syncs data according to each provider's authorization model. All workspace members can see synced data within KeystoneIQ. Integration credentials are encrypted at rest using AES-256-GCM.

Access scoping varies by provider. Some providers grant portal-wide or org-wide access once a user authorizes the connection (HubSpot, Gong); others honor the connecting user's row-level permissions (Salesforce, Pipedrive, Zoho); others are strictly per-user (Notion, Confluence). Review the Authorization Scope column carefully, and for regulated environments, connect a dedicated integration user with least-privilege scopes (see guidance below).

Dedicated Integration User (recommended for regulated environments)

For enterprise deployments, we strongly recommend connecting KeystoneIQ using a dedicated integration user rather than a named employee's account. This provides predictable, auditable access scoping, avoids disruption if the employee leaves, and maps cleanly to least-privilege principles.

• HubSpot: Create a user with only the required crm.objects.*.read scopes enabled. Because HubSpot grants portal-level access on authorization, the scopes are the only real boundary. Keep them minimal.
• Salesforce: Create a dedicated Integration User profile with a permission set limited to read access on Opportunity and Account. Apply sharing rules and field-level security to further restrict what KeystoneIQ can see.
• Pipedrive / Zoho / Copper: Create a read-only user assigned to only the visibility groups / roles whose deals should flow into KeystoneIQ.
• Gong: Use a scoped API key rather than an admin-level key if available on your plan.
• Zendesk: Issue an API token for a dedicated agent whose ticket views match the tickets you want KeystoneIQ to analyze.
• Notion / Confluence / cloud file storage: These are already per-user or per-account scoped. Share only the spaces/folders containing competitive material with the KeystoneIQ integration.
• GA4: Grant the dedicated user Viewer role on only the properties whose traffic data should flow into briefs.

Data Processing Agreement

If your organization requires a DPA for GDPR or similar regulatory compliance, contact support@keystoneiq.ai.

Public API (/api/v1/*) CORS policy

The public REST API at /api/v1/* returns Access-Control-Allow-Origin: * to allow integrations (Zapier, Make, custom scripts) to call it from any origin. This is safe by design because:

• No cookie-based auth. The API accepts Bearer tokens only (Authorization: Bearer sk_...). Access-Control-Allow-Credentials is explicitly false, so browsers will not attach cookies on cross-origin requests even if an attacker tries to force them.
• API keys are workspace-scoped and revocable. Every call is authenticated with an HMAC-SHA256-hashed key tied to a single workspace; owners can rotate or revoke at any time from Settings → API.
• Per-IP rate limiting. /api/v1/* is guarded by a 60-req/min sliding-window limit (see lib/ip-rate-limit.ts) to prevent brute-force key guessing.
• Session-cookie routes are NOT part of this policy. All user-session APIs (/api/workspace/*, /api/invites/*, etc.) rely on same-origin cookie delivery under Next.js defaults and do not emit a wildcard CORS header.

Related policies

• Privacy Policy
• Terms of Service
• Cookie Policy

Last updated: April 29, 2026