This page describes the security practices currently in place for Matimo™ Suite of Products, operated by ROAIQ™ Technologies Private Limited. We aim to keep this page accurate and specific rather than aspirational, where something is in progress, we say so. For our data-handling practices, see the Privacy Notice; for our position on formal certifications, see Compliance.
1. Infrastructure
Matimo™ Suite of Products runs on Amazon Web Services (AWS): ECS Fargate for application workloads, RDS PostgreSQL for primary storage, ElastiCache Redis for caching and queues, and AWS Secrets Manager for infrastructure secrets. Access to production infrastructure is restricted to authorised engineering staff.
2. Encryption in Transit
All traffic to the Platform is encrypted using TLS 1.2/1.3. Plain HTTP requests are redirected to HTTPS, and we send an HTTP Strict Transport Security (HSTS) header to keep browsers on HTTPS for future visits.
3. Encryption of Credentials
Sensitive credentials you provide to the Platform, including third-party OAuth tokens and any LLM provider API keys you configure, are encrypted at the application layer (AES-256) before being written to storage, and decrypted only at the point of use during execution. Infrastructure secrets (database credentials, service keys) are held in AWS Secrets Manager rather than in application code or configuration files.
We are actively extending storage-level (disk) encryption coverage across our underlying database and cache infrastructure as part of ongoing hardening work. If encryption at rest for your data store is a hard requirement for your organisation, contact security@matimo.ai before onboarding sensitive workloads.
4. Tenant Isolation & Access Control
Matimo™ Suite of Products is multi-tenant by design. Every data access path is scoped to your tenant at the application and data-access layer, reinforced by PostgreSQL Row-Level Security policies on the underlying database as defence in depth. Within a tenant, role-based access control governs what each user can view or change, and administrators control team membership and permissions.
5. Authentication
Accounts are protected with signed JWT access/refresh tokens, email verification, and session revocation on logout or password change. Sign-in today is via email/password or Google/Microsoft OAuth. SAML-based Enterprise SSO is on our roadmap and not yet available.
6. Human-in-the-Loop & Tool Governance
Agents that call tools capable of taking real-world action (for example sending a message or modifying a record in a connected system) can be configured to require human approval before executing, based on a risk classification of the tool call. This is a control your administrators configure per agent; it reduces, but does not eliminate, the risk of an agent taking an unintended action. Review your configuration for anything you connect to production systems.
7. Audit Logging
User and system actions, including logins, agent executions, tool calls, approvals, and configuration changes, are written to an audit log your tenant administrators can review, supporting incident investigation and internal accountability.
8. Incident Response & Breach Notification
We maintain an internal process for investigating and responding to security incidents. In the event of a security incident affecting your data, we will notify you without undue delay and provide the information reasonably available to us about the incident, its impact, and remediation steps, consistent with our obligations under applicable law (including the Digital Personal Data Protection Act, 2023, see our Privacy Notice, §13).
9. Reporting a Vulnerability
If you believe you've found a security vulnerability in Matimo™ Suite of Products, please report it to security@matimo.ai with enough detail to reproduce the issue. Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and avoid accessing, modifying, or deleting data that isn't yours in the course of testing. We will acknowledge reports within 3 business days and will not pursue legal action against good-faith security research conducted consistently with this policy.
10. Your Responsibilities
Security is shared: you're responsible for keeping your account credentials confidential, configuring appropriate approval gates for agents connected to sensitive systems, and granting your team members only the access they need. See §4 of our Terms of Use for account-security obligations.
11. Changes to This Page
We update this page as our security practices evolve. Material changes will be reflected here with an updated "Last updated" date.
12. Contact
Security questions or reports: security@matimo.ai. General support: support@matimo.ai.