Credential handling
Keep service credentials server-side. Credentials and scopes are provisioned during controlled onboarding. Do not expose credentials in browser, mobile, client logs, or URLs.
Tenant and authorization boundaries
Human actors use a Supabase access JWT and remain ownership-scoped. Service credentials are bound to one organization and explicit scopes; scope requirements are shown for every operation in the API Reference.
Request integrity
Supported writes use organization-scoped idempotency keys. List cursors are opaque and signed. API errors include a request ID for support correlation; do not put sensitive client content into support tickets or application logs.
Developer site protections
This site enforces a same-origin Content-Security-Policy with clickjacking protection, nosniff, strict-origin referrer handling, and a restrictive Permissions-Policy. HSTS is served by the hosting edge.
Data handling
Use only data required for the integration and follow your organization’s privacy obligations. PsyMind’s public privacy information is available at psymind.app/privacy. This page does not claim a certification, compliance program, retention commitment, or service-level agreement.
Report a concern
For security questions or a responsible disclosure, contact contact@psymind.app with a minimal reproduction and no customer secrets.