Security at Dino

Dino is an AI-powered API quality and security platform. Customers connect their APIs, and Dino tests, documents, and monitors them. Because Dino handles your API definitions, your credentials, and the results of testing your systems, security is built into how the platform works. This page describes the controls in place today.

Architecture and hosting

Dino runs on Cloudflare's developer platform (Workers, D1, R2, KV, and Vectorize) for its control and data planes, and on Google Cloud Run for managed runner compute. Scans run either on Dino-operated runners or on runners you host yourself.

Your data is partitioned by region. See our Data Residency page for the regions we offer and how your data stays in region.

Tenant isolation

Every customer is an isolated tenant. All data access is scoped to your tenant at the database layer, and cross-tenant access is structurally prevented:

• Every query against shared data includes a tenant boundary.
• Runners are bound to their work. Dedicated and self-hosted runners carry a tenant-scoped identity token. Shared pool runners are tenant-agnostic and receive a per-scan capability token, bound to one runner, one scan, and one tenant, with a short lifetime, that authorizes exactly one scan and nothing more.
• Result submission is gated so a runner can only write results for the scan and tenant it was assigned.

Encryption

• Your API credentials are encrypted at rest with AES-256-GCM using a unique key derived for each tenant. A master secret is run through HKDF (SHA-256) to derive a per-tenant key, so one tenant's key can never decrypt another tenant's data.
• Data in transit is protected with TLS.
• Credentials are write-only: once stored, they cannot be read back through the product. You see only a masked hint. Plaintext exists only briefly in memory at scan time. See our Credential Handling page.

Authentication and access control

• Authentication is provided through Stytch. Dino supports Single Sign-On (SSO) and SCIM provisioning and deprovisioning.
• Multi-factor authentication is supported and can be enforced across your organization.
• Sensitive account actions, such as disabling MFA enforcement, changing session timeout, creating or revoking API keys, and deleting a workspace, require a fresh step-up re-authentication. These actions fail closed: if the re-authentication is cancelled or fails, the action does not proceed.
• Role-based access control governs in-product permissions.

Auditability

Security-relevant and administrative actions are recorded to a tenant-scoped audit log, including runner registration, member changes, settings changes, workspace deletion, and quota events. Audit log access is available on plans that include it.

Secret hygiene

Dino is built so your secrets do not leak into operational surfaces. Sensitive values such as Authorization, Cookie, and API-key headers are redacted at the shared logging layer. How credentials are stored and used is described on our Credential Handling page.

Network and abuse controls

• Tenant-scoped rate limiting protects the platform.
• Scans are bounded by request, progress, and time budgets, so a scan cannot run unbounded against a target.
• Scanning conduct is governed by our Authorization to Test and Acceptable Use policies.

Development and change management

Dino uses peer code review, automated testing, and continuous integration before deployment. Database changes are applied through versioned, reviewed migrations.

Vulnerability management

Dino runs continuous automated dependency and code scanning. Independent penetration testing is part of Dino's security program ahead of its SOC 2 examination. Researchers can report issues through our Vulnerability Disclosure Policy.

Resilience

Customer data is stored on managed, replicated infrastructure (Cloudflare D1 and R2). Configuration and code are version-controlled and reproducible, and Dino maintains defined recovery objectives for service restoration.

Compliance

Dino is SOC 2 ready and is pursuing a SOC 2 examination. Dino is not yet SOC 2 certified. See our Compliance page for current status, and our Data Processing Agreement and Data Retention and Deletion Policy for our data commitments.

Contact

Report a security concern to security@usedino.dev or follow our Vulnerability Disclosure Policy.