Security
Your tokens and data, handled with care
An import tool holds keys to your Airtable bases and to the APIs you connect. These are the safeguards Rowvela applies, in plain terms.
Secrets
- Airtable tokens, API keys, OAuth tokens, uploaded files, previews and run history are encrypted at rest with AES-256-GCM.
- Secrets are never returned to the browser, never included in exported configurations and never written to logs.
- A stored credential is bound to the source host and authentication type. Changing either requires entering the secret again, so it cannot be redirected to another server.
- OAuth uses authorization code with PKCE where the provider supports it; refresh tokens rotate and are refreshed one at a time.
Accounts and sessions
- Passwords are hashed with scrypt (N=2¹⁴, r=8, p=5). Unknown accounts take the same time to check, so sign-in does not reveal who has an account.
- Sessions use random HttpOnly, SameSite=Strict, Secure cookies. Only hashes of session ids, invitation, reset and webhook tokens are stored.
- Every change requires a CSRF token; cross-origin requests are rejected.
- Failed sign-ins are throttled per address, per account and per address and account together, so a stranger cannot lock you out.
- Changing the account email notifies the previous address.
Network
- Sources must be public HTTPS hosts on port 443. DNS answers are validated and pinned, and private, loopback and reserved addresses are refused. This prevents server-side request forgery against internal networks.
- Redirects, credentials in URLs and unsafe headers are rejected; TLS certificates are always validated.
- Responses are capped at 5 MB, including after decompression, to stop compression bombs.
- Airtable requests go only to
api.airtable.com. Uncertain writes are never replayed automatically.
Isolation and access
- All data belongs to a workspace, and every query is scoped to it. Imports cannot reference connections, files or imports of another workspace.
- Owners manage members and connections; Creators build and run imports.
- User expressions run in a restricted grammar; JMESPath transforms run in an isolated worker with limits.
Operations
- The database is backed up automatically at least daily with an integrity check and rotation.
- The encryption key is not part of database backups, so a leaked backup alone does not expose secrets.
- The app sends a strict Content Security Policy and HSTS, and embeds no third-party analytics or tracking.
- Unexpected server errors are reported to the operator by email with tokens masked.
An internal review in October 2026 covered workspace isolation on every route, CSRF and origin checks, sessions, brute force, SSRF, XSS, SQL and formula injection, webhook signatures and dependencies. An external penetration test is planned before public launch.
Data sent to providers
When you use a template, the values you choose (a domain, a URL, a prompt, an attachment) are sent to that provider under its own terms. Each integration page says what is sent. Rowvela itself does not use your data to train models and does not sell or share it.