Session content
Redacted conversations, tool activity, and the files or commands a session refers to. The local sync service only captures sessions in repositories allowlisted by your organization.
Pre-launch security overview
Share your agents’ work within your team – not with anybody else.
Powerplant records coding-agent sessions so your teammates and their agents can work with shared context. That only works with a clear boundary: visible inside your organization, never beyond it.
The short version
- Captured work in allowlisted repositories is shared with members of your Powerplant organization. It is not public and there is no cross-organization sharing mode.
- You can delete traces uploaded from your agents from Powerplant.
- Secret-shaped text is redacted before laptop sessions leave the machine, and before cloud-agent transcripts enter long-term storage.
- Raw transcripts are stored separately from account, session, cost, room, and derived-product data.
- Provider credentials are encrypted with AES-256-GCM and are never returned through the product API.
- Production and staging use separate databases, raw-storage buckets, AI-tracing projects, and analytics projects.
- Organization owners can request deletion. We run the deletion deliberately and confirm in writing when it is complete.
The organization is the boundary
Powerplant is transparent by default inside a team. Everyone in an organization can see its captured agent work; people outside it cannot. That boundary is enforced in both the application API and the database’s row-level security policies.
Your connected agent uses Powerplant through OAuth. The agent interface only accepts tokens issued for it, tokens expire within an hour, and every data request remains limited to your organization. Each request is also checked against the live grant you approved; revoking that grant from your Profile takes effect on the client’s next request.
Your agents’ workSecret redactionYour organizationYour agents’ work
Secrets are scrubbed before storage
For laptop sessions, Powerplant redacts credentials on your machine before upload. For Cursor cloud sessions, the same redaction runs on Powerplant’s server before the transcript is written to the raw-data store.
The redactor removes known secret-bearing fields and scans text for credential formats including API keys, access tokens, connection-string passwords, private keys, and secret-looking environment variables. Stored text is redacted again before full tool-call arguments are served through MCP.
What Powerplant stores
Collaboration history
Rooms, comments, decisions, instructions, presence-derived state, and the person responsible for durable actions.
Derived readings
Summaries, search excerpts and embeddings, friction patterns, measured usage, and cost records derived from sessions.
Security records
Attributable audit events and redacted MCP query text. Query text is visible only to organization owners and admins and expires after 365 days.
Storage, credentials, and observability
Session metadata and product data live in Postgres. Redacted raw transcripts live in a separate Cloudflare R2 bucket. The application only joins those tiers for work that needs the transcript.
Credentials you connect for services such as Cursor or Anthropic are encrypted at rest with AES-256-GCM. They are write-only through the product API, and a repository-level architecture test prevents the encrypted credential column from appearing outside its owning service.
Operational logs and error reports are scrubbed and do not intentionally contain transcript content. Product analytics contain identifiers, tool names, outcomes, and measured durations—never transcript text, SQL text, or search phrases. Browser session replay is off.
Infrastructure and service providers
These are the services that can process or store Powerplant data today. Customer-selected integrations such as Cursor and GitHub remain under the customer’s own relationship with those providers.
| Provider | Purpose | Data involved |
|---|---|---|
| Render | Web, API, and pipeline hosting | Requests and transient application processing |
| Supabase | Postgres, authentication, and realtime | Accounts, organization data, session metadata, and derived records |
| Cloudflare | R2 raw-data storage | Redacted raw session objects |
| Anthropic & OpenAI | Model and embedding processing | Relevant session excerpts, prompts, and derived inputs |
| Braintrust | AI traces and cost debugging | Model prompts and results; production traces are human-access-only |
| Sentry | Error and performance monitoring | Scrubbed diagnostics; default PII collection is off |
| Better Stack | Operational logs and uptime | Scrubbed application and infrastructure telemetry |
| PostHog | Product analytics | Identifiers and bounded product events; session replay is off |
| Linear | Product feedback | Feedback report text, your organization’s name, and the sending member’s email address |
| User sign-in | Basic account identity and profile information |
Your data, and deletion
Most data stays while your organization is active because the shared history is the product. Today, organization deletion is a verified, human-run operation requested by an owner, though self-serve org deletion is coming soon.
The operation removes the organization’s live database records, known raw transcript objects, derived snapshots, encrypted provider credentials, and organization-tagged Braintrust traces. It leaves content-free security audit records with their organization link severed. We confirm what was deleted and when.
Exact deletion-response, backup-expiry, and AI-trace retention windows are still being verified for launch. We will not publish invented numbers in the meantime.
How we test the boundary
Security invariants run in our comprehensive test suite: organization isolation, row-level security, credential containment, token lifetimes, framing policy, migration safety, and source redaction all have executable checks.
Powerplant also has an adversarial MCP audit harness. It creates two synthetic organizations in a non-production environment, probes authentication and cross-organization isolation with ordinary credentials, verifies cleanup, and treats missing coverage as a failure or a named exception. It is an internal control, not an external penetration test or certification.
Compliance
Powerplant is pre-launch. We are not yet SOC 2 certified and have not completed an external penetration test. We are building the audit trail, access boundaries, deletion path, secret handling, and deployment controls we expect those reviews to inspect.
If your organization needs a particular control, DPA, or security document, email founders@forestwalk.ai. We would love to partner with a customer who has specific security requirements, but is also keen to get the benefits of Powerplant, and could help us accelerate our in-progress security hardening and validation work.
FAQ
Does Powerplant read every file on my computer?
No. The local sync service reads supported coding-agent session records. It only uploads sessions in repositories allowlisted by your organization; you can inspect and change its configured scope.
Who can see a captured session?
Members of your Powerplant workspace. Powerplant is designed for workspace-wide transparency, not private one-person session storage.
Can secret redaction guarantee that nothing sensitive gets through?
No automatic filter can make that promise. We redact known credential fields and formats at capture and again on sensitive serving paths. Text inside images is the clearest current limitation. If your organization would like early access to configurable, AI-powered redaction within Powerplant, get in touch!
How do people sign in?
Production currently uses Google sign-in. If your team needs Enterprise SSO or passkey support, get in touch!
Can I delete my organization’s data?
Yes. An organization owner can request deletion through the channel your team uses with us. We run the deletion, verify it, and confirm in writing.
Found something?
If you discover a security vulnerability, contact founders@forestwalk.ai. Please include enough detail for us to reproduce it, but do not include credentials or customer data in your first message.