Trust
Security and data handling
Tobie works with HR and benefits data. The API gives every caller the least access it needs, checks it twice, and keeps a record of each call. This page explains how, in plain words.
- No cookies, no keys in URLs
- Bearer only
- Life of each database token
- 5 minutes
- Default API key expiry
- 90 days
- SOC 2
- In progress
Architecture of least privilege
Every request is narrowed three times: by the API, by a short-lived database token, and by the database itself.
Bearer credentials only
The API learns who you are from one place: the Authorization: Bearer header. It sets no cookies, and it rejects an API key placed in a URL.
A five-minute database token
For each request the API signs a fresh ES256 token that lasts five minutes. Queries run as tobie_api, a database role that cannot log in on its own (NOLOGIN).
Checked twice
The API checks scope and tenant before anything runs. Row-level security in the database then checks every row again, so one mistake in code does not expose data.
Bound to a tenant
Each credential is bound to the employers it may see. Anything outside that scope does not exist for the caller: the answer is 404, never a hint.
Credentials
Two ways in. Both are scoped, both expire, and both can be revoked.
API keys
- Start with
tobie_sk_live_ortobie_sk_test_, so a leaked key is easy to spot and a test key cannot reach live data. - Stored only as a SHA-256 hash. Shown once, when created.
- Expire after 90 days by default.
- Can be limited to an IP allowlist.
- Can be revoked at any time.
OAuth 2.1 for AI apps
- Sign-in runs through Supabase Auth with PKCE (S256).
- The person sees which app is asking and what it may read, and approves it.
- Access tokens are short-lived. Apps never hold a standing key.
- A grant can be revoked at any time. The next call fails with
grant_revoked.
More in Authentication and Scopes and permissions.
Data handling
We keep what we need to run and audit the API, and nothing that would expose what people asked.
What logs never hold
Request bodies, credentials and tokens, or the text of questions people ask. Error responses never echo the values you sent.
What logs do hold
The time, route, status and latency of each call, and which credential and sign-in method made it. IP addresses are stored hashed. Raw request logs are kept for 90 days.
No PHI through the API
Tobie does not process protected health information (PHI) through the API. Employee answers come from plan-level documents, such as plan summaries and benefit guides, not from claims or medical records.
In transit and at rest
All traffic uses HTTPS. Stored data is encrypted at rest by our database provider.
Employer controls
Rolling outEmployers decide whether their people can bring Tobie into personal AI apps, and which apps.
Off until HR turns it on
Personal AI access starts off. HR turns it on for their company.
Approved apps only
HR decides which AI apps employees may connect.
Every connection visible
HR can review the connections at their company.
Monitoring and edge
Limits, a firewall and an audit trail sit around every call.
Rate limits per principal
Budgets count per person or key, so extra keys do not raise them. Failed credential checks are limited per network. See Rate limits.
Edge firewall
Traffic passes through the Vercel firewall, with its DDoS protection, before it reaches the API.
Audit events
Every call records who made it, with which credential and sign-in method, and which operation or tool ran. Never bodies, never secrets.
Emergency stop
One switch turns the API off for everyone while a problem is fixed. Callers get 503 with Retry-After. Live checks are on the status page.
Compliance
Where we stand today, stated plainly.
SOC 2
In progressSOC 2 is in progress. Tobie has not completed a SOC 2 audit and does not hold a SOC 2 report yet. We will update this page when that changes.
Subprocessors
| Subprocessor | What it does |
|---|---|
| Vercel | Hosting, edge network and firewall |
| Supabase | Database and sign-in (authentication) |
| Anthropic | AI answers |
| AI answers | |
| Cloudflare | DNS |
We keep this list current. Changes are announced in the changelog.
Responsible disclosure
If you find a security issue, we want to hear about it.
Email security@tobie.team. Include the steps to reproduce, the URL or MCP tool involved, and any requestId values from the responses.
Our security.txt lists the same contact.
While you test, please:
- Use only accounts, keys and data that are yours.
- Do not read, change or delete other people’s data.
- Do not run tests that slow down or break the service.
- Give us time to fix the issue before you share it.