4Sign inClaim 50% Off
← All Legal Documents

Last updated:

Security & Trust

Security isn't a bolt-on enterprise upsell at FrogBot—it is built into both the open-source MIT framework and the managed Dojo cloud platform operated by FrogBot, Inc.

1. Framework-Level Security Controls (MIT Core)

Every application built with FrogBot inherits battle-tested security primitives out of the box:

  1. Single Sign-On (SAML 2.0 & OIDC) Included Free: Unlike SaaS vendors that lock SSO behind $25,000+ Enterprise contracts, FrogBot ships SAML 2.0 and OIDC authentication in the open-source core so teams can authenticate via Okta, Microsoft Entra ID, Google Workspace, or Ping from day one.
  2. HttpOnly Session Cookies & Scoped API Keys: User sessions use signed, encrypted HttpOnly cookies to protect against cross-site scripting (XSS) token theft, alongside SHA-256 hashed, role-scoped API keys for programmatic and MCP access.
  3. Row- and Field-Level Access Control (RBAC): Collections are closed by default. Declarative TypeScript access functions execute on every read, write, REST request, Local API call, and AI agent tool invocation—ensuring an AI agent can never read or mutate rows the authenticated user is not permitted to access.
  4. CSRF & CORS Protection: Built-in Cross-Site Request Forgery (CSRF) verification and configurable Cross-Origin Resource Sharing (CORS) allowlists protect every endpoint.
  5. AI Spend Policies & Human Waitpoints: Through FrogBot's AI policy and durable job primitives, administrators can restrict approved LLM providers, enforce hard monthly USD budgets per user, and require mandatory human sign-off before sensitive actions execute.

2. Dojo Cloud Infrastructure Security

When you deploy a FrogBot application to Dojo via npx frogbot share, FrogBot, Inc. enforces strict multi-layered cloud security:

  • Tenant & Database Isolation: Each Dojo application runs in an isolated container environment with its own dedicated Postgres database credentials and scoped S3-compatible object storage prefix.
  • Encryption in Transit and at Rest: All external and internal traffic is encrypted using TLS 1.2/1.3 with automatic SSL certificate provisioning. All Postgres databases, automated daily backups, and uploaded media volumes are encrypted at rest (AES-256).
  • Encrypted OAuth & Secret Vault: Third-party OAuth tokens and environment secrets are encrypted using envelope encryption and injected only into the authorized application runtime.
  • Outbound-Only Local Runner: For hybrid deployments connecting to on-premises databases or desktop software (such as Sage 50), the FrogBot Local Runner establishes an outbound-only authenticated TLS tunnel—requiring zero inbound firewall ports on your corporate network.
  • Automated Backups & Disaster Recovery: Dojo performs automated daily snapshots of managed Postgres databases with point-in-time recovery support on Business and Enterprise plans.

3. Vulnerability Disclosure

We welcome reports from independent security researchers. If you discover a potential security vulnerability in the FrogBot open-source framework or the Dojo cloud platform, please report it privately to legal@frogbot.ai with reproduction details so our engineering team can investigate and issue a patch promptly.