Security at Statio
This page is written to be read during a security review. It covers how people and agents prove who they are, where access is decided, what happens to a credential, what the gateway checks on every call, and what gets recorded.
Sign-in
Single sign-on, short tokens and sessions you can end.
Single sign-on
People sign in through WorkOS, using the authorization code flow with PKCE. Statio then issues its own signed tokens rather than passing the identity provider’s tokens around.Short-lived tokens
Access tokens last five minutes. Refresh tokens last seven days and are replaced on every use; if an old refresh token is ever presented again, the whole session is revoked.Sessions you can end
Every session is listed in the dashboard and can be revoked one at a time or all at once. Signing out also ends the session at the identity provider. A revoked session cannot refresh, and its last access token expires within five minutes.Signed tokens, one algorithm
Tokens are signed with RS256 and carry a key id. Only RS256 is accepted, and services verify signatures against published public keys.Browser sessions
In the web app, tokens live in HttpOnly, Secure cookies. Every state-changing request needs a CSRF token, and responses send HSTS, deny framing and disable content sniffing.
Devices
A stolen token is not enough on its own.
Tokens bound to the device
A person’s laptop enrolls its own signing key, and their access token is bound to it. Each call through the gateway carries a fresh proof signed by that key, covering the method, URL and request body, valid for 60 seconds and usable once. A token copied off the machine cannot call a tool on its own.Two factors to enroll
Enrolling a device key requires a one-time code from an authenticator app. If the check cannot complete, enrollment is refused.Revoke a device, end its sessions
Devices are listed alongside sessions. Revoking one ends every session bound to it.Keys in the keychain
The desktop app keeps the device key and agent secrets in the operating system keychain where one is available. App updates are verified against a signing key pinned in the app before they install.
Agents
Their own identity, never a borrowed one.
Every agent has its own identity
Agents are their own principals, with their own credentials, status and expiry. An agent never acts on a person’s token, and you can suspend or revoke one without touching anyone else.Credentials stored as hashes
Agent client secrets are stored only as hashes and compared in constant time. An agent can hold two active credentials, so you can rotate without downtime, then revoke the old one. Agent tokens last five minutes.Agents need an owner
When an agent’s owner leaves the organization or is demoted, the agent stops getting tokens until a new owner attests to it.API keys cannot call tools
API keys are for automating the dashboard: scoped per key, stored as hashes, with optional expiry, rotation and revocation. The gateway refuses them for tool calls; only people and agents can use tools.
Access
Decided per tool, at the gateway, on every call.
Per tool, not per server
Access is granted to a member or an agent for a server, and individual tools can then be denied or granted on top. A tool-level deny overrides the server grant, so an agent allowed to read a database is not thereby allowed to delete from it.Admins do not get tools for free
Owners and admins can manage everything, but running a tool always needs an explicit grant. Being an admin is not the same as having the keys.Checked at the gateway on every call
In order, the gateway checks:
- who is calling, and that their token is valid
- which organization the call belongs to
- the device proof, for people
- access to the server, then to the tool
- the call itself, with the scanner below
A refused call returns a 403 with the reason, and the API behind it is never touched.
Agents only see what they can use
When an agent asks a server for its tools, the list is filtered to the tools it is allowed to call. Tools that were never registered are blocked.Separation of duties
Every dashboard action has a required role, and an action without one is refused. Approving a server for production is its own permission, separate from deploying it, and only admins can change where a hosted server may connect.
Credentials
Stored encrypted, added at call time, never handed to agents.
Encrypted before it is stored
Each credential is sealed with AES-256-GCM, with its own random nonce, and bound to its record so encrypted values cannot be swapped between rows. The encryption key is kept in Google Secret Manager, outside the database, so a copy of the database alone yields only ciphertext. Keys are versioned and can be rotated without losing access to what is already stored.Added at call time
The gateway fetches the credential when a call needs it and adds it to the outgoing request. The agent never sees the raw key, and the caller’s own authorization headers and cookies are stripped before anything goes upstream.Released only to the gateway
The service that holds credentials hands out credential values only to the gateway’s own service account.
Call scanning
What goes in and what comes back are both checked.
Arguments, before the call
Every tool call’s arguments are scanned for shell injection, SQL injection, path traversal, requests aimed at internal addresses and oversized inputs. A finding blocks the call with “Request blocked by security policy”. Scanning is on by default; an organization can switch it to monitor, but not off.Responses, before the agent
Responses are checked for injected instructions, such as text posing as a system message or asking the agent to send data elsewhere, before they reach the agent. Secrets that appear in a response, including cloud, payment, chat and AI provider keys, private keys and connection strings, are masked before the agent sees them.Tool descriptions, at registration
When a server is added, its tool names and descriptions are scanned for prompt injection and hidden Unicode characters, and anything suspicious is flagged for an admin to review.
Network
The gateway decides where traffic may go.
No requests to private addresses
The gateway refuses to call anything that resolves to a private, loopback or cloud metadata address, and connects to the exact address it checked, so a DNS change between the check and the call does not get through.Egress allowlist per hosted server
Hosted servers have no direct route to the internet. Their outbound traffic is routed through Statio’s egress proxy, which identifies each server by its own credentials and checks every destination against that server’s allowlist. Nothing is allowed until you add it, only port 443 is open by default, a bare wildcard is refused, and every blocked attempt is logged.Limits on everything
Requests are rate limited per address and per organization, with tighter limits on sign-in endpoints. Request bodies are capped at 10 MB, upstream calls time out, and outbound connections require TLS 1.2 or newer.
Hosted servers
Private, unprivileged and scanned before they run.
Hosted servers are private
Servers Statio hosts are not reachable from the internet. Only the gateway can call them, with a signed identity token, and they run under a service account with no other permissions.Minimal, non-root containers
Generated servers run as a non-root user on a patched Alpine base. Statio’s own services run on distroless, non-root images.Scanned before they ship
Catalog servers are scanned with Grype and npm audit for known vulnerabilities, and with Semgrep rules that look for environment exfiltration, unexpected outbound calls, dynamic code execution and sensitive file reads. High or critical findings block the deploy, and so does a scanner that fails to run. Container images you bring are scanned with Grype, and critical findings block them.Our own code
Statio’s dependencies are scanned with Grype on every pull request and daily, against a vulnerability database refreshed each day. Dependabot raises updates weekly, and the Go code is linted with gosec.
Records
Two logs, kept 30 and 90 days unless you shorten them.
Activity: every tool call
Each call through the gateway is recorded with the agent or person behind it, the tool and server, the time, the latency, the status code, the client and the source address. Refused calls are recorded too.Audit logs: every change
Every change to access, servers, secrets, agents and webhooks is recorded with who made it and the result, along with refused attempts. Request and response bodies are never stored in either log.Clear retention
Tool calls are kept for 30 days, audit logs for 90 days and model calls for 13 months on every plan. An admin can shorten the first two in settings, and Enterprise keeps records for up to two years.Export and SIEM
On Business and Enterprise, admins export audit logs, tool calls and model calls as CSV or NDJSON files. Tool calls, audit events, or both can be streamed to your security tooling by webhook, signed with HMAC-SHA256 over a timestamp and the body (X-Statio-Signature and X-Statio-Timestamp), so your receiver can verify each one and reject stale deliveries.
Data
In transit and at rest
Traffic to Statio is HTTPS only. Credentials are encrypted by Statio as described above; everything else lives in Google Cloud SQL, encrypted at rest by Google.Where it lives
The managed service runs on Google Cloud in the us-central1 region.Deletion
Deleting your organization permanently removes its data, audit logs included. Deleting your account removes your devices, connections and keys, and strips your details from the organization's records.
Responsible disclosure
Report a vulnerability
Email [email protected]. We take every report seriously and respond within 48 hours. We do not pursue legal action against good-faith security researchers.
Lock down your first tool in minutes.
Three MCP servers, one of them hosted, and 10,000 calls a month, free and without a card. If you outgrow it the next plan is $19.
Two steps: create your account, then install the desktop app on each machine that runs an AI client.
- Keys encrypted at rest, never handed to an agent
- Cancel anytime, nothing is deleted
- How Statio handles credentials