AITWIRE
Security overview
For vendor and security reviews of AITWIRE.
- Last reviewed
- Questions
- support@aitwire.com
These are the protections that run at AITWIRE today, and only those. Each one was checked on 24 October 2026 against the code we run in production and, where it is visible from outside, against the live service itself.
In the print dialog, choose “Save as PDF”.
Built on Cloudflare
Where AITWIRE runs, and the protection that comes with it.
Cloudflare's network
AITWIRE's website, its app and its API all run on Cloudflare's network, and every visit to them passes through it.
Protection from DDoS attacks
Cloudflare protects the sites on its network from distributed denial-of-service (DDoS) attacks. Its documentation describes this protection as always on, for every customer on every plan.
HTTPS your browser remembers
Once your browser has visited aitwire.com securely, it is told to use only HTTPS for aitwire.com and all of its subdomains for the next two years (HSTS).
No framing by other sites
The pages of AITWIRE's website and app, sign-in included, can't be shown inside another website's frame, which stops a hidden page from tricking you into clicking something (clickjacking). The files AITWIRE publishes for AI systems to read, such as /llms.txt and /.well-known/ai-bundle.html, don't carry this protection.
Signing in
How your AITWIRE sign-in is protected.
Passwords are never stored
Our sign-in service keeps only a salted, one-way hash of each password (PBKDF2-SHA256), never the password itself.
Email confirmed first
A new password account opens only after its email address has been confirmed through the link we send to it.
A protected session cookie
Your session cookie can't be read by scripts on the page, is sent only over HTTPS, and isn't sent along with another website's form posts or background requests (HttpOnly, Secure, SameSite=Lax).
Sign-in only from AITWIRE's own pages
Password sign-in and sign-up accept a request only when it comes from an AITWIRE page, so another website can't sign you in to an account that isn't yours.
Google sign-in stays in your browser
A Google sign-in finishes only in the browser that started it, so a sign-in link someone else made can't sign you in to their account.
Your business's data and your team
Each business has its own account, and each person on it has a role.
Signed in, or turned away
AITWIRE's API turns away any request that isn't signed in, except on a fixed list of public routes, such as the content our public pages show, the return step of a sign-in or a connection, and webhooks that check their sender's signature.
Checked against the business it names
A request that names a business goes ahead only for someone on that business's team, the agency that manages it, or AITWIRE staff, and automated checks in our build look for code that skips this check.
Roles for your team
Each person on your team is an owner, an admin, a member or a viewer. On your team, only owners and admins can manage team seats and API keys, see and disconnect the AI apps connected to your account, connect or disconnect OpenAI Ads and CRMs, and approve facts. If anyone else on the team connects their own AI app, it can only read your account and suggest changes for an owner or admin to approve.
Credentials and payments
What AITWIRE keeps when you connect another service, and what it never sees.
Connected-service credentials are encrypted
The credentials you give AITWIRE to connect Google Analytics, Google Search Console, OpenAI Ads, HubSpot or Salesforce are encrypted with AITWIRE's own keys (AES-256-GCM) before they are stored.
Card details stay with Stripe
Payments go through Stripe's checkout: your card number is entered with Stripe and never reaches AITWIRE.
Staff access and records
What is recorded when our staff open your account, and the records you can export.
Opening your account is logged first
When our staff use AITWIRE's staff tools to open your account to help you, the access is first recorded in a log the database won't let anyone edit or delete. If that record can't be written, the access is refused.
A chained log
Each entry in that log is chained to the one before it by a hash, so a changed entry shows up when the chain is checked.
Export your account's record
On AITWIRE Managed, you can export your account's record (measurements, review decisions, published changes and the logged staff actions on it) as CSV or JSON.
Data processing addendum
Our data processing addendum is published for you to review.