Security
Composio is built with security at its core. We use least-privilege defaults, isolate every organization and project, encrypt credentials, and give you controls over what we store.
Compliance and the Trust Center
Composio is SOC 2 Type II compliant. For our latest reports and certifications (the SOC 2 Type II report, our sub-processor list, and more), visit the Composio Trust Center.
Isolation and access control
- Organizations and projects isolate your resources. Data from one project is not visible to another.
- API keys are scoped, support per-key IP allowlisting, and can opt in to capabilities such as Proxy Execute at creation.
- Multi-factor authentication (MFA) is available for Dashboard sign-in and can be enforced by an organization admin.
Credential protection
- Connected-account credentials, auth configs, and API keys are encrypted at rest using AES-256-GCM, and all traffic is encrypted in transit using TLS.
- Connected-account tokens are redacted by default in API responses, for both Composio-managed and custom auth configs. To act on a provider directly, use Proxy Execute.
- Webhook deliveries are signed; verify the
webhook-signatureheader when handling trigger events. For custom OAuth webhook setup, see Custom OAuth webhooks.
Your responsibilities
Composio executes the tools and connections you configure. You control which toolkits are enabled, which accounts are connected, and what your agents are allowed to do. Review the access you grant, and treat connected-account scopes as you would any production credential.
Reporting a vulnerability
To report a security issue, contact security@composio.dev. Please do not disclose vulnerabilities publicly until we have addressed them.
Related resources
- Data retention: what we store, for how long, and how to stop storing payloads.
- Composio Trust Center: security certifications and compliance.