The controls, and which of them have evidence.

OneLap holds a small amount of data in a small number of places, and most of its security work goes into two questions: can one workspace ever see another, and can anything leave.

Processors of client data

Two. Supabase and Vercel, both in the United States.

Model run by OneLap

none, path closed

Your agent through OneLap MCP

Reads only the workspaces you allowed; cannot accept, send, publish or spend

Analytics on this website

Page views on public pages only, without cookies checked by test

Certifications held

none

The workspace a request may touch is derived on the server from your session and an explicit membership row. The slug in the address bar is treated as a hint and checked against that membership; it never grants anything.

• Row level security on the database. Tables carrying workspace data are constrained at the database, so a query that escaped the application still returns nothing.
• An agent cannot widen its own access. Every call your agent makes through OneLap MCP is checked against the member behind its token, that member’s current membership and the workspaces they allowed. A workspace outside that answers exactly like one that does not exist.
• Instructions inside your material stay untrusted. Text in an imported file, a transcript, or a previous message cannot widen what a tool may reach.
• A workspace you cannot reach answers exactly like one that does not exist. Both return the same 404, and the timing of the two is checked, so the difference cannot be measured either.

Two things in the product accept a request from someone who is not signed in: the waitlist form, and the sign-in steps an agent takes to ask for access to OneLap MCP. Both are built as narrowly as they can be.

An agent asking for access can register itself and open a request, and that is all. The request is kept for ten minutes, registrations are capped per hour, and nothing is granted until a signed-in member allows it on OneLap’s own consent page. Codes and tokens are stored only as digests.

The waitlist form:

• It writes through a single database function that takes two values and writes the rest itself. The table underneath grants nothing to any web-facing role, and row level security on it is enabled and forced with no policy declared, so nothing reachable from a browser can read a row of it.
• Requests are read through one database function that answers OneLap’s owners and refuses every other signed-in person.
• It returns the same answer whether or not the address is already present, so it cannot be used to ask whether a given person has applied.
• It validates in the route and again in the database, and neither layer trusts the other.

Sending client data to an outside service is denied by default. A processor becomes eligible only once its deletion behaviour is contractually and technically established, including its backups, replicas and snapshots. An unknown makes it ineligible, and an ineligible processor receives nothing.

In practice this currently means the strongest possible version of that rule: the production transport that would carry anything outward refuses every request, and no model provider library is even installed. A build gate rejects any import of one outside the approved path, and a second gate rejects raw network clients in application code.

Outward transport

refuses everything

Provider SDKs installed

none

Hidden provider fallback

impossible

Workspace data to analytics vendors

none

An agent you connect through OneLap MCP is not one of OneLap’s processors: you choose it, it reads under your account with its provider, and you revoke it in Settings. If OneLap ever runs a model itself, that provider will be named on the privacy page and in the data map inside the product, with its region, retention and any intermediary, before it receives anything.

• OneLap stores a reference to a secret and never the secret itself. Values live in a machine secret broker, separated per client and per environment, and runtime tokens are read-only and scoped to one configuration.
• A client credential is never shared across workspaces, committed, rendered on a screen, written to a log, or placed in a prompt.
• Revoking an integration stops new reads and writes immediately, invalidates cached authorization, and records an audit event.
• Audit records carry who, what, when, and the outcome. They carry no message content, no prompt, no token, and no secret.

This is the section a security page usually skips. OneLap treats an unproven control the same way it treats an unmeasured number: it names it rather than presenting it as a result.

Analytics kept to the public pages

Proven by a test that scans the whole tree, admits the page-view code in one file mounted only by the public pages, and checks its own detectors against planted samples. evidence

Outward transport refuses everything

Proven in code and covered by tests. evidence

Two-tenant isolation in a deployed environment

Implemented, and the live proof run has not yet been produced. no live evidence

Processor deletion coverage

Both processors are recorded as needing verification. open

Retention clocks

Declared and classified, with nothing scheduled to run them. not enforced

Export of your data

Does not exist in the product yet. no mechanism

OneLap builds a release proof packet tied to an exact deployment, and until every required check in it exists and passes, that packet reports itself as incomplete rather than passing. It is incomplete today. A statement such as “tenants are isolated” is not something this product will claim without that packet, and it is not claimed here.

OneLap holds no SOC 2 report, no ISO 27001 certificate, and no third-party audit. If you need one before you can use a tool, OneLap is not ready for you yet, and that is a straighter answer than a page of badges.

If you find a security issue, report it before doing anything else with it. Do not access another workspace’s data, and do not run a test that degrades the service for someone else.

Security contact

awaiting publisher · contact address

Working route today

The form on the home page, marked as a security report

There is no bug bounty and no reward programme. A report is answered by a person.