How an API credential is stored

A connection credential (bearer token or custom header value) is encrypted with AES-256-GCM using a random 96-bit nonce and authenticated associated data before it is written to PostgreSQL. It is decrypted only when ActionDock dispatches a request through that connection, inside the server process: an owner-approved write, or an agent read (GET) within the connection's method and path allowlist, which needs no per-request approval. It is never written to logs.

No API, MCP tool, dashboard view, or export ever returns a stored credential; the only thing exposed is whether a connection has one. An agent that calls ActionDock sees connection names, allowed methods, and allowed path prefixes, never the secret.

The encryption key is derived from a server-side secret held in the application environment on the production host. There is no hardware security module, no cloud key-management service, and no customer-managed key today; key rotation requires an operator migration. This is listed again under what is not here yet.

Who can release a write, and what exactly is released

Only a signed-in workspace owner can approve or reject a proposed write. Sign-in is a single-use magic link sent to the workspace email, valid for 15 minutes; the resulting dashboard session is an HttpOnly, Secure, SameSite=Strict cookie that expires after 30 days. Workspace API keys reach only the agent API and the MCP endpoint; they cannot call the approval routes, so an agent cannot approve its own request.

Approval is bound to an exact preview: connection version, resolved destination, method, path, query, body, If-Match precondition, and the connection's write-policy mode. If the connection changes between proposal and approval, the proposal is rejected as stale. The binding is checked when the owner approves and twice more immediately before dispatch on a freshly read connection.

A workspace has one owner identity. There are no roles, no named approvers, and no separation between the person who configures a connection and the person who approves a write; a team that needs that today should not rely on ActionDock for it.

Where a request can go

A connection targets one HTTPS base URL on port 443. ActionDock rejects private, loopback, link-local, and carrier-grade NAT addresses, resolves DNS on the server, and pins the outbound socket to the vetted address so the destination cannot change between the check and the connection. Redirects are never followed, provider responses are capped at 1 MB, and requests are aborted after 15 seconds of socket inactivity.

Per connection, the owner allows HTTP methods and path prefixes; a proposal outside them is refused before it ever reaches review. One exception: a connection set to the AI-only write mode has no path allowlist for writes, so any path under its base URL can be proposed, and the owner's approval plus the AI reasonableness check are the only constraints. That check runs only after the owner has approved and fails closed: an unavailable or malformed model answer rejects the write.

ActionDock controls only writes routed through it. An agent that also holds a direct credential, a browser session, or another integration can bypass it; removing those paths is the customer's deployment decision.

Isolation, keys, and limits

Every database query is scoped by the workspace identifier taken from the authenticated key or session; no request can name another workspace. The only exception is an operator-held admin key, kept outside the application database, which can list workspaces and create or revoke a workspace's API keys for support; it cannot approve writes, read credentials, or open a dashboard session. API keys are stored as keyed HMAC-SHA256 hashes plus a 20-character display prefix; session and magic-link tokens are stored as keyed hashes only. Full keys are shown once at creation. Requests are limited to 120 per minute per workspace across all of its API keys, and separately 120 per minute per workspace across its dashboard sessions; sign-up, checkout, and magic-link submissions are limited to 10 per hour per client address, and magic links to 5 per hour per email address.

The service runs as a single application instance in a hardened container (read-only root filesystem, dropped capabilities, no privilege escalation) behind an nginx reverse proxy, with PostgreSQL on the same host. There is no high-availability setup and no published uptime commitment.

What is logged and for how long

Application logs redact the Authorization header, cookies, and request URLs, and never include request or response bodies. Each job record keeps the proposed request, the owner's decision, the terminal state, and the provider's response body as received. That record is returned unredacted to the workspace owner in the dashboard and export, to any agent holding a workspace API key (job and event endpoints, MCP tools), and inside the signed event payload delivered to the workspace's callback URL if one is configured; a provider that echoes personal data into a response leaves that data in all of those places.

Jobs, events, and usage records are kept until the owner deletes the workspace; there is no automatic purge and no configurable retention period yet. Report artifacts older than 30 days (the operator-set default) are purged the next time the server starts or any report is written or listed; there is no timer, so an expired file can linger until then. Server backups are taken with an operator script (a PostgreSQL dump plus a copy of report files); their schedule and retention are set by the operator on the host and are not enforced by the application.

Sub-processors and when they see data

Paddle (merchant of record) receives billing identity and payment details; ActionDock never stores card data. Google (Gemini API) or OpenAI receive whatever an agent passes to the document.analyze, data.extract, and research.web actions (for research.web the query is also run through the provider's web search); receive the approved request's method, path, query, body, and If-Match value together with the owner's reasonableness policy text, with values under credential-like keys and credential-shaped strings replaced by [REDACTED] first, only for connections whose owner enabled an AI write-policy mode; and receive owner-typed setup text when the optional connection assistant is used. A workspace whose agents call none of those three actions, whose connections stay in manual-only mode, and that never uses the assistant sends nothing to a model provider. A transactional email provider delivers magic links and approval notices to the workspace email. Google Analytics (loaded through Google Tag Manager) processes website analytics as described in the privacy policy; for paid, non-test workspaces the server also sends Google Analytics product milestones (sign-up, workspace claimed, connection created, each approved write, purchase and refund amounts with plan and billing cycle) tied to the browser client id captured at sign-up and its acquisition source, never request content, credentials, or job data. The application and its database run on a single hosting provider's Linux host.

No other party receives workspace data. There is no separate data-processing agreement on offer today; the terms and privacy policy govern.

Export everything, delete everything

From the dashboard, an owner can download a JSON export of the workspace at any time: connections without credentials, API keys without secrets, the 10,000 most recent jobs with their previews and provider responses, the 10,000 most recent events, the 10,000 most recent usage records, and the list of report artifacts; the file states that row cap under limits.rowsPerCollection. The same file is available to an authenticated dashboard session at GET /v1/dashboard/export.

Deleting a workspace is self-service and immediate: it cancels the subscription, removes every database row and stored file the workspace owns, and ends the session. Nothing is retained except backups (see above); the raw Paddle webhook receipts ActionDock keeps to de-duplicate billing events, which carry the billing identity Paddle sent; one application log line recording that the workspace was deleted; and the financial records a merchant of record must keep. Analytics events already delivered to Google Analytics are not recalled. Owners can also revoke individual API keys, delete connections, and remove callbacks at any time.

What is not here yet

No independent audit or certification (no SOC 2, no ISO 27001, no third-party penetration test). No single sign-on, roles, or named approver identity. No cloud key-management service or customer-managed keys. No private networking to the customer's systems and no OAuth-based connections; only public HTTPS APIs with bearer or header keys. No audit export to a SIEM beyond the JSON export above, no tamper-evident hash chain on events, and no configurable retention. No high availability.

These are stated so nobody buys on an assumption. When one of them ships, this page changes on the same day.

Reporting a vulnerability

Email support@actiondock.app with the subject "security report". A person reads it; we aim to reply within two business days. Please do not test against other customers' workspaces; a workspace of your own with a mock destination is enough to demonstrate most issues. There is no bug-bounty program.