Trust and security
ThrottleProxy combines tenant-scoped authorization, token-safe collaboration, destination controls, credential separation, bounded resources, and privacy-aware evidence. This page describes implemented controls—not a compliance certification.
Trust path
Follow the path from caller authentication to tenant policy and a narrowly approved public destination.
Implemented controls
These controls reduce common proxy and multi-tenant risks. They do not replace your own application security, provider account controls, incident response, or independent compliance review.
Authenticated requests resolve an active membership and named server-side permission. Customer resource reads and mutations remain scoped to that authorized workspace.
Invitation tokens are single-use, expiring, verified-email bound, and represented in storage only by a SHA-256 hash.
Presented workspace keys are hashed and resolved through one exact Redis key rather than scanning cached configuration.
Targets are restricted to approved hostname patterns, safe protocols and ports, and public DNS answers before an outbound connection is made.
ThrottleProxy authentication credentials, cookies, forwarding credentials, custom proxy headers, and hop-by-hop headers are stripped before upstream forwarding.
Workspace activity and operational lifecycle evidence retain bounded, useful context while excluding credentials and raw invitation material.
Request bodies, response streams, concurrency, queue admission, idle time, and absolute duration have explicit limits and cleanup paths.
Growth and Scale checkout uses signature-verified Stripe webhooks and reviewed entitlement mapping. Starter and Enterprise remain assisted, and automated usage billing remains disabled.
Honest launch boundary
Invitation delivery uses a transient manual link. Billing uses manual plan review. Customer request timelines and provider setup remain labeled previews. Global diagnostics stay behind platform-admin and internal-service authorization.
