Tenant isolation — tested, not promised
Every Oprex row carries a tenant_id; every query filters on it, and every per-id endpoint loads the object together with the caller's tenant (404 for another tenant's object — its existence does not leak). The September 2026 re-audit closed two cross-tenant IDORs and added automated isolation tests that run on every change.
API keys: read · write · admin
- read — read-only tools/endpoints; can never change or delete.
- write — all day-to-day tools (create/update artifacts, run tests), no administrative operations.
- admin — includes SSO, keys, and workspace data-deletion requests.
Scope is a hard server-side fence, separate from roles (owner/maintainer/developer/reporter). Keys are shown once; only a SHA-256 hash is stored; each key has a per-minute rate limit and can be restricted to specific groups/projects.
Your data
- Location: Postgres and S3-compatible object storage on Kinexa servers in Indonesia; encrypted daily backups to a second site, automatic restore test every night.
- Attachments: private per tenant, served through 15-minute signed URLs; only assets you mark public (e.g. profile photos) open without login.
- Lapsed plans: 30-day grace period, then Personal — nothing is deleted or truncated.
- Your rights (Indonesia PDP Law 27/2022): export any time; request deletion of all workspace data — 14-day cancellation window, then every table and attachment is permanently erased with a confirmation email.
AI & agents
All AI goes through the Kinexa Gateway: provider and model are chosen per feature by us, or you bring your own key. Daily quotas apply per workspace and per member. MCP agents obey key scope and tool tiers; unmapped tools are refused (fail-closed). Outbound webhooks are checked against private addresses (anti-SSRF).
UI testing (OTP)
The extension only acts when you press Record/Run; passwords, cards, national IDs and PINs are masked in the browser; the runner may only open origins allow-listed per project; eval is unavailable in the extension.
Reporting a vulnerability
Write to security@kinexa.id. We reply within 2 business days and credit reporters in the changelog on request.