SECURITY
ARCHITECTURE.
Your AI agents run autonomously. That means the credentials, generated assets, and workspace data they interact with must be protected carefully. Here is how we secure the infrastructure.
Infrastructure Security
AgentFramer runs on Cloudflare Workers, deployed across 300+ edge locations. All traffic is protected by Cloudflare DDoS mitigation and WAF.
Persistent data is stored in isolated, encrypted databases. Media assets are stored in Cloudflare R2 with private access controls.
All communication between agents, our API, and generation providers is encrypted in transit using TLS 1.2 or higher.
Authentication & Access
AI Provider Credentials
Provider credentials are stored encrypted at rest and never exposed in API responses or logs.
AgentFramer requests only the permissions required to dispatch generation jobs. No unnecessary scopes are ever requested.
Operational Security
All API endpoints are rate-limited via Upstash Redis to prevent abuse. Agents that exceed limits receive structured errors.
Dependencies are kept up to date and monitored for known vulnerabilities. Critical patches are applied promptly.
Internal access to production systems is restricted to authorized team members using short-lived credentials.
Application errors are captured with PII scrubbing enabled. No sensitive user data or credentials in logs.
Vulnerability Disclosure
If you discover a security vulnerability, please report it responsibly. Do not open a public GitHub issue for security matters. We will respond within 48 hours.
- Describe the vulnerability clearly
- Include reproduction steps
- We will confirm receipt within 48h
- We keep reporters informed throughout
Security reports and general security questions go to our security team.
security@agentframer.com