Supabase Auth
Authenticated sessions protect dashboard.
Security and control
AI actions should be encrypted, explicit, permissioned and visible.
SIMCOAI is designed so customer and business workflows use authenticated access, high-level encryption controls, backend permission checks and reviewable records.
High-level encryption
SIMCOAI uses TLS in transit, encrypted secrets, provider-side encrypted storage and field-level encryption foundations for sensitive payloads.
Row-level security
Operational tables are scoped to authenticated users.
Server-side enforcement
AI data access and update permissions are checked by backend logic.
Scoped secret keys
SIMCOAI API keys should be hashed, revocable, rate-limited and scoped to one business account.
Stripe controls
Checkout and subscription management use Stripe APIs and verified events.
Twilio verification
Production voice webhooks are verified before handling calls.
Logs and notifications
Conversations, calls, automation and notification delivery remain reviewable.
Automation guardrails
Separate permissions for separate risks.
A business can allow the AI to read orders without allowing updates, verify and mark refunds without moving payment, or collect bookings without automatic approval.
Read permissions
Control whether operational records may be included in AI context.
Update permissions
Control whether AI may change order, refund or booking status.
Approval permissions
Automatic approvals require configured rules and policy compliance.
Payment execution
verified refund status marking is a separate, default-off permission.
Responsible deployment
Businesses remain responsible for configuring lawful, accurate workflows.
SIMCOAI provides controls and infrastructure. Customers must configure appropriate policies, notices, permissions, data handling and human oversight for their sector and use case.
The SIMCOAI approach
Security is part of the workflow
01Least privilege
Give AI only the data and actions it needs.
02Verified events
Authenticate external calls and payment events.
03Auditability
Retain records of actions, outcomes and delivery.