Trust & governance
Smohix.run is built for teams accountable for operational changes. This page states what is current, in progress, or planned — without unverified certification claims.
Where operators can inspect controls
These surfaces exist in the signed-in product. Links require authentication where noted.
Audit trail
Operational events — API keys, billing webhooks, approvals, automation activity — are designed to land in one append-oriented log you can export and walk through with auditors.
Audit log →Approvals
High-impact automation waits for an explicit approval record before execution. The queue is a first-class route, not a side channel.
Approvals →Connectors
Optional HTTP backends for reasoning, robot-style automation, and health checks. Nothing runs against your stack until you configure endpoints and credentials.
Connectors →API access & keys
Scripts and integrations authenticate with scoped keys. Keys are created and rotated from Settings; usage flows through the same-origin API surface documented in the reference.
API keys →
Security principles
Technical controls documented as current, in progress, or planned — not certification badges.
Server-side secrets
DocumentedAPI keys, PayPal credentials, and private backend URLs are environment variables — never committed or sent to the browser.
Authentication
DocumentedSupabase Auth protects console routes. Smohix API keys and alert ingest tokens scope programmatic access.
Row-level security
DocumentedWorkspace data is scoped via Supabase RLS and org membership roles.
Webhook verification
DocumentedPayPal and ingest routes verify signatures or tokens where applicable.
Rate limiting
DocumentedSensitive and public API routes use token-bucket limits (Upstash when configured, in-memory fallback).
Formal penetration testing
PlannedNot claimed on this site. Engagements can be discussed through enterprise and security contact.
Privacy principles
Data boundaries and privacy surfaces customers can review today.
Data boundaries
DocumentedWorkspace data stays in your Supabase project context. Connector URLs point to backends you configure.
Privacy policy
DocumentedPublished at /privacy — describes collection, cookies, and contact rights.
Cookie consent banner
DocumentedOptional analytics on smohix.run use a consent banner when NEXT_PUBLIC_ANALYTICS_REQUIRES_CONSENT is enabled. Essential forms work without analytics consent.
Data residency options
In developmentDeployment profiles and retention controls exist in settings; full residency productization is planned.
Responsible AI
How Copilot assistance relates to human approval and grounded same-origin context.
Human-in-the-loop
DocumentedHigh-impact automation routes through approval gates — Copilot assists, it does not bypass governance.
Grounded context
DocumentedCopilot uses same-origin APIs and optional reasoning backends — not uncontrolled external tool execution.
Offline fallback
DocumentedWhen no model is configured, Copilot returns guided offline replies instead of failing silently.
Memory and agent lineage
PlannedAudit-friendly memory lineage is planned — not available today.
Product maturity disclosure
Every product and capability on smohix.run carries an honest label: Live, Preview, Prototype, or Coming soon. We do not present roadmap items as generally available.
View product maturity labels →What we do not claim
Explicit non-claims increase credibility. Absence of a certification is stated plainly — not implied by decorative badges.
- Not claimedSOC 2 Type II certification
- Not claimedISO 27001 certification
- Not claimedHIPAA compliance or BAA
- Not claimedRegulatory approval
- Not claimedGuaranteed uptime SLAs on this marketing site
- Not claimedCustomer logos or usage statistics we have not published
Vulnerability reporting & status
Report security issues via security contact. For runtime availability see service status. Read Security for disclosure expectations.