Security

RobotRock is designed for production approval workflows. This page summarizes security controls relevant to integrators and workspace administrators.

For subprocessors, certifications, and legal documents, see the Trust Center.

API keys

• Create named API keys in the dashboard under Settings → API Keys (admin only).
• Keys are shown once at creation. Store them in a secrets manager — never commit keys to source control.
• Revoke compromised keys immediately from the dashboard. Revoked keys stop working within the API key validation cache window (about one hour).
• Set ROBOTROCK_API_KEY in your server environment for the SDK.

ROBOTROCK_API_KEY=ll_your_key_here

Rotate keys by creating a new key, deploying the new secret, then revoking the old key.

Webhook verification

When you configure a webhook on createClient, RobotRock signs outbound delivery payloads. Verify signatures in your handler:

import {
  verifyRobotRockWebhook,
  RobotRockWebhookError,
} from "robotrock";

export async function POST(req: Request) {
  try {
    const payload = await verifyRobotRockWebhook(req);
    // handle payload
    return Response.json({ ok: true });
  } catch (error) {
    if (error instanceof RobotRockWebhookError) {
      return Response.json({ error: error.code }, { status: 401 });
    }
    throw error;
  }
}

Each workspace has a webhook signing secret (rotatable in the dashboard). See Webhooks for the full payload format.

Data you send in task context

You control what data is included in sendToHuman task context. RobotRock stores that content to display approvers and audit history.

• Do not send payment card numbers, government ID numbers, or protected health information unless your agreement with RobotRock explicitly covers it.
• Use linked attachments instead of embedding secrets in task fields when possible.
• Use task types and app identifiers to separate sensitive workflows.

Audit trail

The dashboard records task lifecycle events (created, assigned, handled, archived, handler delivery, comments). Admins can export audit logs as CSV from the Audit page.

Workspace admins can export a full JSON data bundle from Settings → Data.

Rate limits

API requests are rate-limited per workspace based on your plan. See Settings → Usage for current limits. Use idempotency keys on sendToHuman to avoid duplicate tasks on retries.

Data retention

Task and audit log retention depends on your plan. Expired data is automatically deleted. Retention windows are shown under Settings → Usage.

Report a vulnerability

Email security@robotrock.io. Do not disclose issues publicly before we have had a reasonable chance to respond.

Related

• Trust Center — subprocessors and compliance
• Webhooks — delivery and verification
• Task lifecycle — statuses and expiration