Security
Diomedi is being built as a security-first product. The V1 is static-first, minimal, and designed to avoid unnecessary local or client-side complexity.
Current controls
- Static-first frontend with no local dependency bundle required.
- No advertising trackers in the V1 website.
- Security headers prepared for Vercel and Netlify deployments.
- Supabase schema includes RLS-ready organization, agent, policy, approval, and audit tables.
- Public audit form warns users not to submit production secrets or regulated data.
Responsible disclosure
Security reports can be sent to security@diomedi.xyz. A machine-readable disclosure file is available at /.well-known/security.txt.
Planned enterprise controls
SSO/SAML, SCIM, signed audit logs, connector-specific OAuth scopes, role-based access control, data retention settings, and production evidence exports are planned for paid pilots and enterprise deployments.