Security

What is read, what is never read, where it runs, and who can see what.

What is read

Definitions. For HubSpot: workflows with their triggers, enrollment criteria, branches and actions; forms and the properties they write; lists and their filters; property definitions, groups, pipelines and stage orderings. For GitHub: the files in the repositories you choose. For Google Cloud: the scheduled jobs, functions and services in the project you grant.

What is never read

Records. No contact, company, deal or ticket is ever requested. The scopes the HubSpot private app needs are listed on the connect card and on the HubSpot page; none of them grants access to a record, and the collector would not know what to do with one. Nothing in the product has a place to put a person's data.

Where it runs

On your machine, with tanglemap serve: the app binds to localhost, the graph is a SQLite file in a folder you choose, and every token stays in an env file beside it. Nothing leaves. This is the free tier and it is the whole product.

Hosted: the graph lives in a Postgres database with row-level security, and the collector runs on our side on a schedule. In the hosted plan we hold your tokens, in a secret store the collector reads and nothing else can, the way any connector service does. If you would rather not, the Studio plan runs the collector on your side and sends us only the graph.

Who can see what

A workspace's rows are readable by its members and by nobody else. That is enforced in the database, not only in the app: every table carries a row-level security policy that follows membership, the views the API serves run as the caller, and the anonymous key sees nothing at all. We verified this against the live database before the first workspace existed.

Nothing else

This site loads no third-party script, no analytics, no fonts from a CDN. Open the network tab: the only requests are to this site, and on the app, to the app. The pictures on these pages are rendered from an invented portal, not from anyone's.

Checking the claims

Every request the collector makes is in the run log, which you can open for any collect: the endpoint, the scope it needed, and what came back. The local shell makes the same requests from your machine, where your own network tools can watch them. If you find something, tell us and we will fix it before we say anything else about it.