Security & trust

Switchboard sits between your AI clients and your most sensitive systems. Here's exactly how we protect credentials, isolate tenants, and give you proof of who can touch what — and what you can verify yourself, since the core is source-available.

🔐

Encrypted credential vault

Every integration credential and OAuth token is encrypted with AES-256-GCM before it's written to the database — never stored in plaintext. Ciphertext is versioned so the format can evolve without weakening old data. Rotate or revoke any credential from the dashboard at any time.

🏢

Per-org isolation

Every request is scoped to an organization. Data access goes through a single store interface with org checks on every read and write, so one tenant can never see another's credentials, policies, members, or audit history.

🛡️

ABAC access control

Attribute-based policies — not just roles — decide which member's agent can reach which system and which tools. The server re-checks every decision; a permission string in the UI is a hint, never the boundary.

🔑

Two auth paths, both scoped

Sign in through your identity provider, or issue sb_ API keys for headless agents. Keys are SHA-256 hashed at rest, inherit the owner's live permissions, and are revoked automatically when a member is offboarded.

📝

Tamper-evident audit log

Member changes, policy edits, key creation, integration config, and tool calls are all recorded with actor, action, and timestamp. Retention scales with your plan, up to a full year on Enterprise.

🚪

Outbound-only private tunnel

To reach data behind your firewall, you run a tunnel agent that dials out to Switchboard — no inbound ports. Credentials for those systems stay in your environment, read-only access is enforced on your side, and nothing is stored in the cloud.

Defense in depth

Hardened HTTP responses. Strict Transport Security, a Content Security Policy, X-Content-Type-Options, X-Frame-Options, and a locked-down Referrer and Permissions policy on every response.
CSRF protection. State-changing requests use a double-submit token; authenticated pages are served no-store so stale HTML never reappears after sign-out or an org switch.
Rate limiting. Sign-in, sign-up, API, and MCP endpoints are throttled to blunt brute-force and abuse.
Least-privilege runtime. The MCP runtime has no database access. The control plane pushes only the decrypted config a given org needs, over an internally-authenticated channel.
No plan self-service escalation. Plan changes flow through billing, and role changes are validated against an allowlist — the API can't be used to grant itself more than it should have.

Verify it yourself

Switchboard's core is source-available under the Elastic License 2.0. You can read every line that touches your credentials and data, and for the strictest requirements you can self-host the open build so encryption keys and data never leave infrastructure you control.

Found a vulnerability? We take reports seriously and respond quickly. Email security@switchboard-mcp.com — please give us a reasonable window to remediate before public disclosure.

Governance built in, not bolted on

Policies, audit, encryption, and isolation ship on every plan — you don't buy them back later.

Get Started Free Read the source →