Trust needs evidence.
A clear view of the safeguards implemented in TWB, your choices, and the independent assurance we have not yet obtained.
Technical review · 13 October 2026Implemented safeguards
Your account, your records
The server checks signed-in identity and restricts private data to its owner. Private responses are marked not to be cached by shared caches.
Protected connection credentials
Stored connection credentials use AES-256-GCM encryption, bound to the account and provider. They are not returned to your browser. This is not end-to-end encryption: application infrastructure can decrypt credentials to operate the connection.
Permission before access
Each supported connection explains its access. Sharing selected work requires separate consent. Signing in does not grant access to every AI conversation or authorize subscription changes.
Browser and request safeguards
Private routes use no-store policies. Sensitive flows use secure cookies, origin checks and bounded requests. Production headers include transport, content-type and referrer protections. These controls reduce risk; they do not guarantee that vulnerabilities cannot exist.
The review covers source code and automated tests. It is not an independent audit or a live-account security assessment.
You remain in control
Review permissions before connecting. Each connection explains which records disconnecting removes or retains. Revoke the provider-side grant separately. Export or erase selected work in AI Decisions. Disconnecting does not cancel a provider subscription. The Privacy notice explains retention and backup limits.
Privacy noticeIndependent assurance
TWB does not currently claim ISO/IEC 27001 certification, a SOC 2 report, or CSA Cyber Essentials certification. No independent penetration-test report has been verified. Provider certifications do not certify TWB itself.
Management-system certification
Independent controls report
Singapore security baseline
Scoped application assessment
Our next verification priorities
Independent application testing, hosting and administrator-access review, recovery exercises, and documented security operations. Certification requires scoped evidence and external assessment; no audit completion date is promised.
Report a security concern
Describe the issue through our contact form. Do not include passwords, API keys, private conversations or another person’s data. No response-time guarantee or bounty is offered.