1. Separate system boundary
Enterprise uses a dedicated web deployment, Google Cloud project and OAuth client, Supabase project, database and identity plane, background worker identity, environment variables, and queues. The Enterprise runtime rejects known consumer-project configuration and is not given consumer database, corpus, training-queue, or Google OAuth credentials. This is an access boundary enforced by deployment authority, not a promise implemented only through application flags.
2. Identity and tenant access
The hosted pilot has no public sign-up path. Existing invited users authenticate through the dedicated Enterprise identity provider. Organizations use owner, administrator, analyst, and viewer roles. Tenant tables enable and force database row-level security; membership checks are performed in hardened database functions, and management actions derive the acting identity from the authenticated session rather than a browser-supplied user identifier.
3. Google authorization safeguards
The YouTube connection asks for four explicit read-only scopes and refuses grants with missing or additional permissions. Authorization state is signed, short-lived, bound to the user and organization, and paired with PKCE and a one-time HttpOnly attempt cookie. The service verifies the Google account and owned channel before accepting a connection.
Access and refresh credentials are protected with AES-256-GCM authenticated encryption bound to the organization and connection before database storage. Browser roles have no table grant or policy that can select credential ciphertext. Disconnecting asks Google to revoke the grant before deleting the local credential and imported data.
4. Tenant data integrity
Imported records carry organization and connection ownership through composite foreign keys. Direct browser mutation of provider evidence is revoked. Bounded database functions validate provider payload shapes, keep catalogue writes idempotent, preserve dated snapshots, validate retention points, and store query and response hashes with each retention curve. The interface distinguishes unavailable data and partial provider responses rather than manufacturing fallback values.
5. Background processing
A separately deployed Enterprise worker performs bounded Google requests. Work is stored in a tenant-scoped forced-RLS queue, claimed through short atomic leases, serialized per connection, and checkpointed after committed catalogue pages. Lost leases and transient provider failures become explicit retry states; permanent authorization failures become visible reconnect-required states.
6. Revocation and lifecycle controls
Normal provider work revalidates the authorization, and a dedicated schedule covers otherwise idle connections at least daily. A failed or revoked authorization starts a short reconnect deadline backed by a database constraint and automatic purge. Related YouTube Authorized Data is deleted as soon as possible and within seven calendar days of revocation. An explicit in-app disconnect revokes and deletes immediately when Google confirms the revocation.
7. Logging and failure handling
Application and worker logs use allowlisted error categories and exclude access tokens, refresh tokens, encryption keys, credential ciphertext, and raw provider payloads. Sync and worker failures remain visible as durable states so an interrupted or invalid request cannot silently appear successful.
8. Client responsibilities
Clients should invite only authorized representatives, protect their Google and Enterprise accounts, assign the least role each person needs, review connected applications, and promptly disconnect or notify us when an account, employee, or engagement should no longer have access. Do not send passwords, tokens, private keys, or other secrets through support email.
9. Reporting a security concern
Send suspected vulnerabilities or incidents tosupport@addictd.aiwith “Enterprise security” in the subject. Include the affected URL, time, and a concise description, but do not include live credentials or client data. We will triage the report and coordinate next steps. This page describes current controls; it is not a claim of a certification or third-party audit that has not been completed.