Security model
Peki runs AI agents that talk to your customers, call your systems and act on their own. This page explains, at the level a customer or a security reviewer needs, how each part is protected and what you control.
The principles
| Principle | What it means for you |
|---|---|
| Your workspace is yours | Nothing in one workspace can be seen or changed from another. |
| Least privilege | Every person and every key gets only the role it needs, and the role is checked on every request. |
| Keys stay secret | Keys are encrypted, never shown again in full, never seen by the AI and only sent to the sites you allow. |
| Customer data stays out of the model | Personal data is replaced with placeholders before an AI model sees it. |
| Data is data | Web pages, tool results, files and webhook bodies are information for the agent, never instructions to it. |
| Real effects need a person | Publishing, restoring versions, widget changes and writes made by automations or during Copilot tests wait for your approval. |
| Everything important is recorded | Changes are written to an audit log with who made them. |
Workspace isolation
- Every piece of data belongs to exactly one workspace, and every request runs inside one workspace.
- For people, Peki checks on every request that you're an active member of the workspace and that your role allows the action. A removed member or a changed role takes effect on the next click, not at the next sign-in.
- An API key belongs to one workspace and can't be pointed at another.
- An id from another workspace behaves like an id that doesn't exist:
404. You can't even learn that it exists. - Agents are separated inside a workspace too: secrets, the Copilot and automations act on a single agent, never beyond it.
Roles and access
Five roles, from Viewer to Owner, decide what each member can do. See Members and roles for the full table.
- Only admins manage members, API keys and workspace settings. Only owners manage other owners or delete the workspace.
- A workspace always keeps at least one owner.
- The Copilot never acts beyond the role of the person using it.
Sign-in
People sign in with Google or with a one-time email link. There are no passwords to leak. The sign-in session in the browser is kept in a cookie that page scripts can't read.
API key hygiene
- Keys are shown once when created. Peki keeps only a fingerprint, so a stolen database copy wouldn't reveal them.
- Each key has an access level: Read only acts as a viewer, Read and write as an editor. No key can ever act as an admin or owner, and endpoints for people only (members, keys, approvals, the Copilot) refuse every key.
- The list shows each key's first and last characters and when it was last used, so you can find and remove unused keys.
- Revoke works on the next request.
- Creating and revoking keys is audited, and changes a key makes are recorded as made by that key.
See API keys for how to store and rotate them.
Secrets
Secrets are the keys your agents' tools use to call your systems, like your shop's order API.
- Encrypted at rest. After saving, only the last four characters are ever shown, to anyone.
- Never seen by the AI. The model only knows a secret's name and last four characters. Peki adds the key to the request on its side, after the model has decided what to call.
- One agent per key. A key belongs to one agent, and only that agent's tools can use it.
- Bound to sites. Each key has Allowed sites and is only ever sent there. A tool that tries to send it anywhere else fails with a clear message. Only admins can change a key's sites, because pointing a key at another site is how someone would read it.
- Signing secrets for webhooks are only used to check signatures and are never sent anywhere.
- Pasted keys are caught. If someone pastes a key into the Copilot chat, it's removed before the model sees it. Add keys through the Copilot's API key card or Settings → Secrets.
- Adding, assigning, removing and re-pointing secrets is audited.
Personal data
Turkish ID numbers, card numbers, IBANs, phone numbers, email addresses and, optionally, customers' names are replaced with placeholders like [TCKN_1] before an AI model sees them. The real values are encrypted, per conversation, and only your tools receive them where you allow it. Every model call goes only to providers that don't keep your data. See Data and privacy.
The Function sandbox
Functions are small pieces of code that the agent can call as tools, often written by the Copilot. Because their code can come from a model, every run is locked down:
| Protection | What it does |
|---|---|
| Isolated run | Each run gets its own fresh, short-lived process. Nothing is shared between runs or between customers. |
| No local access | The code can't read or write files, read the server's settings, start other programs or load other code. |
| Network only through a proxy | The code can reach nothing directly. Every request goes through Peki's egress proxy, which allows only the sites listed in the Function (up to 10). |
| Keys added by the proxy | The code never holds your secret. It names a secret the Function is allowed to use, and the proxy adds it to the request, only for that secret's own allowed sites. |
| Time limit | 1 to 10 seconds per run (5 by default), then the run is stopped. |
| Memory limit | 128 MB. |
| Request limit | 20 outgoing requests per run. |
| Result limit | 16 KB. |
| Approval | A Function can be set so each call waits in Approvals until an editor approves it. |
The proxy also applies the same rules as HTTP tools (below), so a Function can't reach your private network.
Safe outgoing requests
HTTP tools, Functions, web pages the agent reads and knowledge pages Peki fetches all go through the same protections:
- No private or local addresses. Requests to localhost, private networks, link-local addresses (like cloud metadata services) and other reserved ranges are refused. The address is checked after the host name is resolved, at the moment of connecting, so a host name can't be quietly pointed at an internal service.
- Redirects are never followed. A tool gets the redirect response itself.
- Time limits. An HTTP tool waits 1 to 30 seconds (10 by default).
- Size limits. Responses over 1 MB are refused.
- Only what you choose reaches the AI. An HTTP tool can keep just the response fields you list, and personal data in responses is replaced with placeholders.
- Data is data. Responses and web pages are given to the model as information, never as instructions.
The website chat
The website chat runs in your visitors' browsers, so it's public by design and tightly scoped:
- Allowed websites. If you list your sites, only those exact addresses can use the chat; other sites get
403. With an empty list, any site can show it, so add yours. - One visitor, one conversation. A visitor is identified by a random id created in their browser. It's their only credential, and it reaches only their own conversation. Peki stores only a fingerprint of it.
- Files. A visitor can open only their own uploads and files your team sent them. Every other file id gives the same
404, whether it exists or not. - Rate limits per visitor, per network and per chat stop floods and scraping. See Website chat API.
- Turning it off makes the chat's address stop answering at once.
- The chat never uses or exposes an API key.
Incoming webhooks
- Each webhook URL contains a long random secret that can't be guessed. Renew URL and Revoke URL stop the old one at once.
- Signature checks for Stripe, Shopify, GitHub or any HMAC-SHA256 sender, compared in constant time. Stripe signatures older than 5 minutes are refused.
- Replays are ignored. The same event within 24 hours runs once.
- Unsigned writes are opt-in. An automation that writes something won't run on unsigned requests unless you explicitly accept that.
- Limits on size (256 KB) and rate (60 per minute per URL).
- A paused or unknown URL answers the same
404, and only a masked preview of each body is kept.
See Incoming webhooks.
Files
- The file type is checked from the file's content, not its name. SVG and HTML are never accepted, so a "photo" can't carry a script.
- Files are served with headers that stop a browser from running anything inside them.
- Files are stored privately and reach people only through Peki, the customer's own chat or your API key.
- Text inside documents is read as information, never as instructions, and gets the same personal-data placeholders as messages.
Approvals for real effects
Actions with effects outside Peki, or that make something live, wait for a person:
- publishing a version and restoring an older one,
- changes to the website chat made by the Copilot,
- writes during Copilot test runs,
- the writes an automation makes, approved when you save it,
- tools and Functions you mark for approval, which wait in Approvals for an editor.
Audit log
Every important change is written to the workspace's audit log: who acted (a member or an API key), what they did, on what, and when. That covers members and roles, API keys, secrets, channels, knowledge, variables, record tables, deleted agents, rejected webhook signatures and more. Secret values and record contents are never written to it. See Data and privacy.
What you can do
- Give each person the lowest role that works. Keep Owner for one or two people.
- Use one API key per system, with Read only where possible, and revoke unused keys.
- Set Allowed sites on every secret and Allowed websites on the website chat.
- Turn on signature checks for every webhook whose sender supports it.
- Leave Protect personal data on.
- Remove members the day they leave.