Security at Citai

Each organization operates in a fully isolated environment.

• Vector embeddings are stored with a mandatory tenant_id on every row

Sensitive data protected with industry standards.

Robust JWT system with automatic rotation.

• Refresh tokens last 7 days with automatic rotation

Production stack with multiple layers of protection.

• Redis for rate limiting with sliding window (sorted sets)

Two access levels with granular permissions.

Multi-factor authentication and social login to safeguard account access.

• QR code generation for quick setup

Hardened HTTP headers and proactive error monitoring.

• X-Frame-Options for clickjacking protection

Built-in tools for data protection regulation compliance.

• Account deletion (GDPR Art. 17) — soft delete with password confirmation

Full traceability of critical actions across the platform.

• Configurable retention period (in days)

Granular control over what content the system can generate and display.

• REDIRECT rules: redirect queries to predefined answers

Strict separation between platform metadata and tenant content.

• All queries scoped by tenant_id (no bypass)

External integrations protected with cryptographic signing and guaranteed delivery.

• Automatic retry with exponential backoff (3 retries: 1s, 5s, 30s)

Specific limits per operation type to prevent abuse and brute-force attacks.

• Registration: max 5 accounts per hour per IP