How Liitora keeps you safe

Who this is for: admins, security reviewers and anyone who wants to know how Liitora protects their data.

Before you start: it helps to read What Liitora does first.

Liitora lets AI assistants write workflows for you. That is powerful, so we built it around four rules.

1. Workflows run in a closed sandbox

Every script step runs in its own sandbox: a JavaScript engine compiled to WebAssembly, started fresh for each run. Nothing is shared between runs or between companies.

A script can only use the functions Liitora gives it (the host API): read its input and trigger data, read a secret by name, call a connection or an HTTPS address, read and write small state values, write files (artifacts), write log lines and metrics.
There is no file system, no network access of its own, no environment variables, no eval, no import and no way to start other programs.
Each run has limits on CPU, memory, run time, output size and log size. A step that goes over a limit is stopped with a clear error, such as timeout or memory_limit.
Before a workflow is saved, Liitora checks its scripts and rejects risky code, such as code that tries to run other code or reach hidden globals. This check gives early feedback; the sandbox is what actually keeps the code in.

Built-in actions, such as sending an email or building a CSV, run inside Liitora with the same rules: they reach the outside world only through the checks below.

2. Every outbound call is checked

All HTTP calls a workflow makes go through one guarded client:

HTTPS only. Addresses with a user name or password in them are refused.
The address is looked up once, and every IP address it points to must be public. Private, internal, loopback and cloud metadata addresses (such as 10.0.0.0/8, 192.168.0.0/16, 127.0.0.1 and 169.254.169.254) are blocked. The connection is then pinned to the checked address, so a second, different DNS answer can’t be used to sneak in.
Redirects are not followed unless a connection allows redirects to the same host.
Requests and responses have size limits and timeouts.

A connection adds its address, the hosts it may call and the sign-in. The sign-in is added by Liitora; the script never sees the token or key.

3. People own the secrets

Passwords, API keys and tokens are called secrets. Only people in your company can enter or read them.

Values are stored in a separate secret store (OpenBao), under a path of your company only. Our database holds only names and statuses.
Your AI assistant can ask for a secret by name, but it never sees the value. You enter the value on a Liitora page, not in the chat.
Liitora removes secret values from every log, output, error message, saved state, file and stored result, also when they are encoded (for example base64 or URL-encoded). Credential headers such as Authorization are masked in the HTTP log. Every release is checked by a test that runs a workflow trying every way to keep a secret and then searches the whole database, the stored files and the answers of the API and of AI assistants for it.
A script that changes a value on purpose (for example reverses it) can get past this. That is why a draft that no person approved reads only the secrets that an approved version already reads, and why an approver should read the scripts that use secrets.
Scripts, with: values and test data that contain a password or key are rejected when an AI assistant wrote them.
Showing, changing or deleting a secret is recorded in the audit log.

4. Each company’s data is kept apart

Every request is checked against the one company its sign-in belongs to. Roles come from Liitora’s own records, checked on every request, never from the sign-in token.
The database enforces the same rule a second time (row-level security), so a mistake in one place doesn’t expose another company’s data. Another company’s object always looks like it doesn’t exist.
An AI assistant connection is tied to one company. It can’t switch to another.

Your password must be at least 12 characters and can’t be your user name or email address.
After 10 wrong passwords in a row, signing in pauses for a minute, and longer after each further try, up to 15 minutes. The pause ends on its own, so nobody can lock you out for good.
When you connect an AI assistant such as Claude or ChatGPT, Liitora asks you to approve it on a consent screen first. An assistant never gets access to your account without that step.
Sign-in pages are the only part of the sign-in service open to the internet. Its admin tools are not.

A person always decides

AI assistants create drafts. By default, a person must approve a workflow version before it runs for real, an AI assistant never approves, a version a person wrote needs a second approver unless they are the only one, and a version can’t be activated until its tests pass. See How AI agents are kept safe.