> For the complete documentation index, see [llms.txt](https://docs.trycaliber.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.trycaliber.ai/trust/security-and-privacy.md).

# Security and privacy

How Caliber protects credentials and tenant data. Rewritten for current product behavior.

## Authentication

| Path                   | Mechanism                                                        |
| ---------------------- | ---------------------------------------------------------------- |
| Dashboard users        | Google or Microsoft OAuth (Supabase Auth, JWT cookies)           |
| Device / plugin ingest | Org Bearer ingest tokens (hashed at rest, looked up per request) |

Access to an org requires membership (invite or Entra domain join). See [Sign in and get access](/getting-started/sign-in-and-get-access.md).

## Credentials at rest

Third-party API keys and OAuth tokens are encrypted before storage (AES-256-GCM). Decryption happens at point of use for sync jobs and connection tests.

## Tenant isolation

Every customer row is scoped to an organization. Dashboard queries run in the authenticated user’s org context. Caliber does not sell or share customer data with third parties for their marketing, and does not train foundation models on your Caliber data.

## Per-stream handling

| Stream               | Handling                                                                                                                             |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| Provider usage APIs  | Aggregated usage/cost/roster fields per connector; no IDE source pull via GitHub’s stated policy                                     |
| OTel                 | Lossy usage metrics; does not replace durable billed cost when both exist                                                            |
| Analysis transcripts | Client `redactDeep` before ship; server size limits; used for workflow insights and, if entitled, policy screening on enrolled users |
| Git notes            | Authorship maps in customer SCM; Caliber syncs note metadata via GitHub                                                              |
| Slack                | Outbound only                                                                                                                        |

## In transit

Browser and API traffic use TLS. Outbound calls to providers use HTTPS.

## Human sign-off

Before publishing this site publicly, a Caliber owner should confirm this page matches the latest retention and Analysis enrollment policy for customers.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.trycaliber.ai/trust/security-and-privacy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.