Security

Last updated 12 August 2026

Tissue runs untrusted code from many customers on shared infrastructure, so isolation and least privilege are built into the architecture rather than bolted on. This page describes how we protect your workloads and data.

01 Workload isolation

Every Cell runs inside its own V8 isolate: a lightweight, per-request sandbox with no ambient filesystem, network, or process access. A Cell can only reach the platform services it is explicitly bound to (c3 databases, g7 buckets, vault secrets), and only its own account's resources. Cells never talk to storage backends directly; all access is brokered by our internal services.

02 Encryption

All traffic to tissue.systems is served over TLS, with certificates issued automatically by Let's Encrypt. Data is encrypted in transit between our edge and internal services. Vault bindings (type = "vault") are stored encrypted at rest and injected into a Cell only at dispatch time, so plaintext secrets never live in your deployed bundle.

03 Authentication & access

Passwords are hashed with a modern, salted algorithm. Sessions use short-lived, signed JWTs. API tokens (tok_…) carry an explicit, least-privilege scope allow-list across 22 scopes, so you can issue a token that can, for example, read Cells but not delete databases. Tokens can be revoked at any time from the dashboard.

You can turn on two-factor authentication with an authenticator app, backed by single-use recovery codes. Signing out every other session and CLI login is one action, and it takes effect on the API within fifteen seconds rather than waiting for those sessions to expire. We email you when a recovery code is spent, and — unless you turn the notice off — when your account signs in from a device and network it has not been seen on in the last 30 days.

An account can have more than one person on it. Each membership records a role — owner, admin, or member — and that role caps what the member's sessions and tokens are permitted to do, so nobody can mint a token carrying a scope they do not hold themselves. Removing a member ends the sessions they hold and deletes the API tokens they issued on that account; moving a member to a narrower role re-cuts their tokens to what the new role allows.

04 Data location & redundancy

Structured data (c3) and objects (g7) are stored on infrastructure we operate across multiple regions, with object data replicated for durability. Configuration is coordinated through a replicated cluster so a single-node failure does not take the platform offline.

05 Operational practices

• Least-privilege access to production, limited to a small team.
• Infrastructure managed as code, with changes reviewed before deploy.
• Continuous monitoring and alerting on the platform's health and error rates.
• Regular updates to our runtime and dependencies to pick up security fixes.

06 Your responsibilities

Security is shared. Keep your account credentials and API tokens secret, scope tokens narrowly, store your own secrets in vault bindings rather than in code, and keep your Cell's dependencies up to date.