Security and trust
Exactly what Daryl can touch, and why.
Daryl asks for the least access that does the job, never widens access on its own, and records every change it makes. Here is all of it.
Permissions
Every scope, with a one-line why
| Connection | Scopes | Why |
|---|---|---|
| Supabase (read-only) | Database read | Build the inventory and run shadow mode. |
| Supabase (apply) | Database write | Apply approved fixes. Requested only when you turn on apply. |
| GitHub App | Contents R/W · Pull requests R/W · Metadata R · Checks R/W | Open fix pull requests and show proof and replay as a check. No workflows, administration or secrets. |
| Deploy platform | Deploy hooks | Rescan when you deploy. |
| Slack | Post to one channel | Send approval cards to the channel you choose. |
The narrowing rule
Nothing widens access on its own
Start in Suggest. Move to Act with undo after 72 hours of replay data, and to Autopilot after 3 approved fixes with no breakage.
| When | Suggest | Act with undo | Autopilot |
|---|---|---|---|
| Proven narrowing, no requests denied | Approval | Auto, 30-day undo | Auto, digest |
| Replay shows denied requests | Approval | Approval | Approval |
| Touches auth, definer functions or service role | Approval | Approval | Approval |
| Proof unknown | Approval | Approval | Approval |
| Widening, deletion, key rotation, billing | Never automatic | Never | Never |
| Restoring the exact prior state after a breach | Automatic | Automatic | Automatic |
The proof
What it covers, and what it doesn’t
The proof covers Daryl’s policy model and the patterns it supports: a row column equal to the signed-in user, membership through a join table, boolean flags, role checks and claim equality. Anything else is marked unsupported and goes to a person, with replay as the only evidence. We say “proven narrowing, replay-verified”, never “formally verified database”.
How we run Daryl
Practices
- Your data
- Daryl never copies table rows. It stores schema metadata, policy text, grants, function definitions and request shapes with user IDs hashed.
- Isolation
- Every customer table in our own database has row-level security; one organization can’t read another’s rows, and our application can’t bypass it.
- Encryption
- Connection tokens and personal fields are encrypted at rest, field by field. Everything travels over TLS. We never store a service-role key.
- Sign-in
- Email sign-in links plus a required second factor for every account, with passkeys supported. Sensitive actions ask for the second factor again.
- Audit
- Every change Daryl makes, and every action by our own staff, lands in an append-only audit log you can read.
- Certifications
- We don’t have SOC 2 or ISO 27001 yet. We’ll say so until we do, and send our security questionnaire on request.
Public numbers
Check our work
- Breakage rate
- Every fix applied, every rollback and every undo, by month.
- Transparency log
- Every receipt as a hash in an append-only log you can verify.
- Subprocessors
- Who processes data for us, by role.
Disclosure
Found a problem?
Email security@getdaryl.com. We acknowledge within 3 business days and consider good-faith research authorized under our Vulnerability Disclosure Policy. Researchers who report valid issues are credited here, with their permission. None yet.