Security
Security by construction
The controls below are implemented and tested in the current release.
- Tenant isolation
- Every user request runs under database row-level security for the caller's memberships. Cross-organization references are blocked by constraints, not just by application code.
- Least privilege
- Five roles (viewer, runner, editor, admin, owner). API tokens are bound to one organization and a set of scopes, stored only as hashes, and expire.
- Secrets
- Your AI provider keys are encrypted with AES-256-GCM under a master key held outside the database, decrypted only at call time, and never returned.
- Uploads
- Material is screened for credentials and patient identifiers before storage or AI processing; flagged sources are quarantined.
- AI boundaries
- Documents are passed to AI models as data, never as instructions. AI output is validated against schemas and never executed.
- No code execution
- WorldSpecs cannot contain code, expressions or URLs. Models and metrics come from versioned registries.
- Integrity
- Credit ledgers are double-entry and append-only; audit events cannot be edited. Run exports carry checksums.
What we do not claim yet
Alive has not completed an independent security assessment and holds no security certification. Do not upload real patient data. Report a vulnerability to team@alivehealthtech.com.