Security

How to report

If you believe you have found a security vulnerability in Iconic, email security@withiconic.ai. Please include:

• What you found and the impact you think it has.
• Where: the page, web address or feature involved.
• How to reproduce it, step by step.

What we ask

• Use your own account and test data. Do not access, change or delete anyone else’s data.
• Do not disrupt the service for other people, or test with spam or social engineering.
• Give us time to fix it before you share details publicly.

What happens next

• Within 72 hours, we aim to confirm we received your report.
• Within 5 business days, we aim to send you a detailed update on what we found.
• Within 90 days, we aim to fix the issue and agree with you on when to disclose it publicly.

Your Iconic account

You sign in to Iconic with your Google account, and Google checks your password, so your Google password never reaches Iconic. A few accounts we create for app directory reviewers sign in with a username and password instead.

Connecting an AI assistant

Claude, ChatGPT and other assistants connect to Iconic with OAuth 2.1. You approve the connection on a consent page, and the assistant receives a token, never your Google credentials.

• Proof Key for Code Exchange (PKCE) is required on every sign-in, using S256.
• Dynamic client registration lets an assistant register itself without a shared secret.
• Refresh tokens change each time they are used. If an old one is ever reused, every refresh token from that sign-in is revoked.

Teams

Every team member has a role, from owner to viewer, that controls what they can see and change.

In transit

Iconic is served over HTTPS, so what you send and receive is encrypted on its way to and from withiconic.ai.

At rest

Secrets you add to a project, such as API keys, are encrypted with AES-256-GCM before they are stored. Once saved, a secret’s value is not shown again, and Iconic lists secrets by name only. Your project receives the value when it runs. The credentials Iconic creates for each project, such as its database keys, are encrypted the same way.

Your project’s database

Each project has its own separate database. A new database blocks all reads and writes by default, and only the permission rules set for that project allow access.

Who helps us run Iconic

The companies that help us run Iconic, and the data each one handles, are listed under Subprocessors in our Privacy Policy.

Get in touch

• Security reports: security@withiconic.ai.
• Privacy requests: privacy@withiconic.ai.
• Everything else: support@withiconic.ai, or see Support.