Authentication
Passwords are stored as salted hashes. Create account starts with a work email, sends a six-digit Resend code, then asks for a name and password after verification. A short success transition opens the workspace. Common personal and disposable domains are blocked, including subdomains; BLOCKED_EMAIL_DOMAINS adds deployment-specific exclusions. This is a domain blocklist, not proof of employment. Sessions use expiring HttpOnly cookies and mutations check origin.
Password changes and recovery
Choose Forgot password on Login, or Change password from the admin or workspace navigation. The password recovery page works for admins and owners, including signed-in users. Verify the email code, choose and confirm a new password, then log in again. All existing sessions for that account are invalidated. The saved database hash is authoritative; restarting cannot restore a bootstrap password.
Codes expire in 10 minutes, allow five guesses, and have a 60-second resend cooldown and hourly send limit. Signup and reset codes cannot be interchanged. Verification produces a single-use, ten-minute token for setting the password. Resending replaces the old code and token. No account is created until verified signup completes. Reset requests use a generic response that does not disclose whether an account exists.
Email and environments
RESEND_API_KEY and RESEND_FROM are required on the Node server for both local development and production. Emails include an embedded TheAIPods logo, so they do not require public access to localhost. Delivery failures do not claim success. Codes are never returned to the browser or printed to the terminal. The same flow uses local SQLite or hosted PostgreSQL via DATABASE_URL. Different databases hold separate accounts and passwords.
Cloudflare may proxy the Node/Railway server. Use the public HTTPS origin for APP_URL and COOKIE_SECURE=true in production. This repository is not a direct Cloudflare Workers/D1 deployment. The small envelope-and-X error indicator animates once, retains accessible text, and respects reduced-motion preferences.
Company isolation
Companies, knowledge and Pods are scoped to their owner. The API checks ownership on reads and writes, including selected knowledge and downloads. The admin role has a separate authorized console.
Controls are not certification
The app contains permission fields, approval gates, audit history and an execution stop control. These implementation features do not constitute a SOC 2, ISO, HIPAA or GDPR certification. Production use needs deployment-specific review, backups, monitoring, secret management and integration testing.
Sensitive data
Only upload information you are permitted to use. A live gateway receives selected company context and evidence, so evaluate the gateway’s data handling before connecting it. Public demo examples use fictional content.