Security
Farm Apo handles API credentials that grant authority to perform transactions. We treat security with the seriousness that requires.
Credential Security
All stored credentials encrypted at rest with envelope encryption. Master keys never exposed to application layer.
API keys are processed server-side only. Nothing sensitive reaches the browser or client application.
Third-party API keys are encrypted client-side before transmission. Server cannot read plaintext secrets.
Automatic rotation schedules. Instant revocation. Last-used tracking. Provider permission display.
Application Security
TLS 1.3 for all communications. Certificate pinning on desktop application.
Custom provider URLs validated against private networks, loopback, cloud metadata endpoints. DNS rebinding protection.
Per-account, per-key, per-endpoint rate limits. IP-based throttling. Brute-force protection.
Every API request, credential access, and state change logged with request ID, timestamp, and user context.
Regular automated dependency scanning. Known vulnerability monitoring. Supply chain security practices.