Built for teams that cannot afford mistakes
CentaurX is built on enterprise security principles: full human control, per-tenant data isolation, end-to-end encryption and complete traceability of every action.
CentaurX's 4 security pillars
Each pillar covers a different layer: operational, access control, data and traceability.
Human-in-the-Loop
No agent executes changes in your CRM without your explicit approval. Every action is proposed, not executed.
- checkProposals with context, impact and alternatives
- checkApproval by channel (UI, email, Slack)
- checkInstant cancellation before execution
Granular RBAC
Full control over who can do what. Predefined roles + customizable permissions per workspace.
- checkRoles: Admin, Manager, Rep, Viewer
- checkPermissions per module and action type
- checkPer-tenant workspace isolation
Data Encryption
Integration tokens are encrypted with AES-256 before storage. No sensitive data travels in plain text.
- checkAES-256 for HubSpot OAuth tokens
- checkTLS 1.3 on all external connections
- checkAutomatic session token rotation
Audit Trail
Every agent action is logged with timestamp, approving user, payload and result. Immutable.
- checkStructured log of all executions
- checkExportable for compliance audits
- checkConfigurable retention per plan
Implemented technical controls
Every control is live in production and validated with automated tests.
CSRF Protection
Double-submit CSRF tokens on all mutation routes. Implemented in csrf.ts with middleware validation.
Token Encryption
tokenCrypto.ts encrypts all OAuth tokens with AES-256-GCM before persisting them to the database.
Rate Limiting
Two layers: rateLimiter.ts (in-memory for dev) and rateLimiterRedis.ts (production) with sliding window per IP and tenant.
Prompt Sanitization
promptSanitizer.ts validates and cleans all inputs before sending them to the LLM to prevent prompt injection.
PKCE + OAuth 2.0
Authentication flow with PKCE (pkce.ts) for HubSpot. Eliminates the authorization code interception vulnerability.
TOTP / 2FA
Two-factor authentication available via totp.ts. Compatible with Google Authenticator and any TOTP app.
HubSpot integration: your data, under your control
CentaurX only reads and writes to HubSpot through HubSpot's official API. We never store copies of your CRM data outside HubSpot.
Shared responsibility model
As with any enterprise platform, security is a shared responsibility.
| Area | CentaurX | Your team |
|---|---|---|
| Infrastructure & encryption | CentaurX responsibility | — |
| User permissions & roles | Tools provided | Configuration |
| Integration tokens | Encryption & rotation | Revocation if compromised |
| Data in HubSpot | — | Customer responsibility |
| AI action approval | Proposal system | Mandatory human approval |
Security questions?
Our team responds in under 24h. Architecture documentation also available for enterprise.
mailContact the security team