Security
Last updated: 15 January 2026
Our approach
We don't chase security badges or make certification claims we can't back up. Instead, this page describes, honestly, the practical steps we take when we build and operate the site and the systems we deliver for clients. Security is a practice, not a checkbox — treat this as an accurate description of our current posture, not a guarantee that nothing can ever go wrong.
How we build
- Secrets stay server-side. API keys, database credentials, and other secrets used by this site and by systems we build are kept in server-side environment configuration — never shipped to the browser or committed to source control.
- Server-side validation. Form submissions and other inputs are validated on the server, not just in the browser, so a bypassed or manipulated client request still gets checked before it's processed or stored.
- Least-privilege database access. Application credentials used to reach our database are scoped to what that application actually needs, rather than broad administrative access.
- Transport encryption. Traffic between your browser and our site travels over HTTPS.
- Dependency hygiene. We keep the libraries this site depends on reasonably current and remove ones we no longer need, to limit exposure to known issues in third-party code.
- Environment separation. Development and preview environments are kept separate from production data where practical, so testing doesn't touch live client information.
- Access control. Access to production systems, hosting dashboards, and client data is limited to the people directly involved in delivering that work.
- Logging and monitoring. We rely on our hosting and infrastructure providers' logging to spot unusual activity or errors, and we review this when something looks off rather than only after the fact.
Incident response
If we identify or are notified of a security issue affecting the site or a client's system, we investigate promptly, take reasonable steps to contain and fix it, and notify affected clients directly with what we know, what we've done, and what's next. We don't have a formal public-disclosure timetable to advertise, but we treat notification as a priority, not an afterthought.
Shared responsibility
Security on a delivered automation system is a shared effort between us and the client:
- We own: the architecture and code we write, how we handle credentials during a build, server-side validation and access control within systems we operate, and being transparent about known risks in what we deliver.
- The client owns: the security of their own accounts and platforms we integrate with (strong passwords, multi-factor authentication where offered), who on their team has access to the delivered system, and keeping any credentials they manage directly protected after handover.
Client credentials and API keys
During a build, we sometimes need temporary access to a client's tools or API keys to connect systems together. We request only the access needed for the task at hand, store it in server-side configuration rather than in code, and remove or rotate access we no longer need once a project is complete. Where a platform supports scoped or role-based access, we ask for that instead of full account access.
Data minimisation in automations
When we design an automation, we default to moving and storing only the fields a workflow actually needs to do its job — not a full copy of every system it touches. Where a workflow doesn't need to retain data long-term, we design it to pass information through rather than accumulate it.
Report a vulnerability
If you believe you've found a security issue with this website or one of our systems, please email instinctautomation.ai@gmail.com with a description of the issue and steps to reproduce it. Please don't attempt to access data that isn't yours, disrupt the service, or publicly disclose an issue before we've had a reasonable chance to address it. We'll acknowledge genuine reports and keep you updated as we investigate.
Related policies
Questions? Email instinctautomation.ai@gmail.com.