Encrypted credential
User credentials (OAuth tokens, API keys, passwords) stored encrypted at rest. Encryption ensures that even an internal database read does not expose plaintext credentials.
Why it matters
A database breach that exposed plaintext credentials would be catastrophic. The agent has read access to your inbox, write access to your Stripe, OAuth into 20+ services. A leak of those credentials is the largest single-point-of-failure in the system.
Symmetric encryption at rest (AES-256 or equivalent) is the industry-standard mitigation. The encryption key is held separately from the database; even an attacker who exfiltrates the database does not get the credentials.
How Ajeris handles this
All user credentials (OAuth tokens, integration secrets, API keys) are encrypted at rest using industry-standard symmetric encryption. The encryption key is managed in a separate keyring; database read access does not include key access. Token refresh and decryption happen at runtime, just-in-time, not in batch. Combined with tenant isolation, even a worst-case incident has bounded blast radius.
