The boring parts, written plainly.

Watchpost decides whether your AI agent can spend money. That's a sensitive job. This page is what we do to take it seriously.

Eight things we treat as non-negotiable.

Encryption in transit

Every request to watchpost.systems and the API uses TLS 1.2 or higher. HSTS is enabled on the apex domain.

Encryption at rest

Database storage and backups use the encryption-at-rest controls supplied by our managed hosting provider. Backup retention follows the production database plan and settings.

Hashed credentials

Password authentication and hashing are handled by Better Auth. Watchpost stores the resulting hash and never intentionally writes a plaintext password to application logs.

Tokens stored as hashes

Agent connection tokens are SHA-256 hashed in the database. The raw token is shown to you exactly once, when it's issued. If the database leaked, no usable tokens leak with it.

Least-privilege access

The support console requires a verified account with an explicit STAFF role. Every individual account lookup through that console creates a durable audit entry.

Environment-scoped secrets

Database, signing, billing, OAuth, email, and cron credentials are supplied through deployment environment variables. Production validation rejects missing or known-placeholder secrets.

No card data, ever

Watchpost never sees a card number, CVC, or expiry. Stripe handles that. We hold a customer ID and a subscription state, and that's the whole picture.

Logs without secrets

The API request logger records method, path, status, and timing rather than request bodies or authorization headers. Hosting-provider retention remains an operational setting.

How a token actually works.

1. 01
   Generated locally

   When you authorize an agent in the browser, we generate a 32-character base32 token. It looks like wp_ABCD…XYZ.

2. 02
   Hashed before storage

   Before the token is saved, it's hashed with SHA-256. The database row contains the hash and an 8-character prefix used for UI listing. Nothing else.

3. 03
   Shown to you once

   The raw token is sent back to the CLI installer over a one-time exchange code. It's written into your agent's MCP config and never displayed again.

4. 04
   Validated on every call

   When your agent calls the API, the bearer token is hashed and compared. A revoked or unknown token is rejected before any work begins.

5. 05
   Revocable any time

   Revoke a connection from the dashboard. The token is marked revoked immediately. The next API call fails closed.