Store where, never what.

The website runs on Vercel. Data lives in MongoDB Atlas. Both encrypt data at rest by default, and every connection uses TLS.

The full list of providers is on the subprocessors page.

Passwords are hashed with scrypt. We never see or store them in plain text. Sign-in is rate-limited.

Sessions last 7 days and live in an HTTP-only cookie that page scripts cannot read. You can see every device you are signed in on and sign any of them out. Changing your password signs out your other devices.

An access key is shown once. We store only its SHA-256 hash and a short prefix. Keys belong to one project, have a permission (read only, or read and propose drafts), an optional expiry and a limit of 60 requests per minute.

Every snippet we give you reads the key from an environment variable, so it never lands in your repo. Revoking a key cuts off the agent at once.

PoketProject stores where a secret lives (a vault path, an environment variable name), who owns it and which services use it. It never stores the value.

Every write, upload and agent call is scanned. A file that looks like it holds a key, a token or a password is refused, and the error never repeats the value. The activity log cannot contain a value by construction.

What an AI agent writes is Needs review until a person checks it. Rules, decisions and secret references always need an admin, because rules steer agents and a planted rule could do harm.

PoketProject runs no AI model on your code. Your own agent reads the code on your machine; the website receives only the .poket files you sync.

Workspaces have four roles: Owner, Admin, Member and Viewer. Every page and API route checks the role. People who are not members of a workspace get a 404, so a project's existence stays hidden.

Cross-site requests to the API are blocked. Security headers (HSTS, frame denial, a content security policy) are set on every response.