> For the complete documentation index, see [llms.txt](https://oodlz-ai-studio.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oodlz-ai-studio.gitbook.io/docs/architecture-and-stack/security-data-handling.md).

# Security & Data Handling

Where credentials live, how data is isolated, what the brand controls — security in plain language for non-technical readers.

> **Credentials in their right place, brand data in its own infrastructure, audit trail on every action.**

Security in this system isn't bolted on — it's architectural. Credentials live where they belong. Brand data is physically isolated. Every action is logged. The brand never has to manage tokens, never sees raw secrets, and never shares infrastructure with another brand.

## How It Works

### Where Credentials Live

Credentials never live in the workspace or in workflow JSON. They live in 1 of 2 places:

* **n8n credential store** — every connected platform (Google, Meta-graph, LinkedIn, TikTok, X, Zernio, Gmail, WordPress) is connected via the n8n credential store, encrypted at rest. Workflows reference the credential by name; the actual token never appears in workflow definitions.
* **Workspace credential reference only** — the workspace stores the credential name as a pointer for audit purposes, not the credential value. Reading the workspace gives no path to a connected token.

### Authentication Methods

* **Google services** (Search Console, Analytics) — OAuth2 with read-only scopes. No long-lived API keys.
* **Meta-graph** (Instagram, Facebook) — Bearer tokens with the minimum required permissions (`instagram_basic`, `instagram_manage_insights`, `read_insights`).
* **LinkedIn, TikTok, X** — OAuth2 or platform-issued bearer tokens, scoped per platform.
* **Zernio, WordPress** — API tokens issued by the respective platform, stored in the n8n credential store.

### Brand Data Isolation

Every brand runs on dedicated infrastructure — own n8n instance, own workspace, own vector index. The brand's data is physically isolated, not just logically partitioned. See [Multi-Tenant Isolation](/docs/architecture-and-stack/multi-tenant-isolation.md) for the architectural detail.

### Audit Trail

Every workflow run logs to the workspace — what triggered it, what it did, what it returned, when it finished. Failed runs include error context. Channel connections track last verified time and any error messages. Human escalations log the full conversation reference.

## What You Get

* Credentials encrypted at rest in the n8n credential store — never in workflow JSON, never in the workspace.
* OAuth2 for every Google service — no long-lived keys to rotate.
* Per-brand infrastructure — physical data isolation, not row-level filtering.
* Audit trail on every workflow run — what, when, result.
* Connection status visible in the workspace — disconnected or errored credentials surface immediately.
* No tokens ever appear in the brand's view — the workspace shows credential names, not values.