Verified account routing
Account state determines whether the user reaches personal, enterprise, setup, suspended, or internal surfaces.
SECURITY / IMPLEMENTED BOUNDARIES
Memory access is constrained before it reaches the browser.
This page documents controls present in the current product and deployment. It does not claim certifications that have not been completed.
01 / IMPLEMENTED CONTROLS
Security follows the same boundaries as memory.
Scoped device authorization
Codex connections use a browser approval flow. Protected credentials stay in the Electron main process or server environment rather than the browser UI.
Tenant and Scope separation
Personal, enterprise, and project memory requests are resolved through server-controlled account and scope boundaries.
Server-side memory proxy
Personal and enterprise clients call same-origin server routes. Tenant control credentials are not placed in browser JavaScript.
Separate internal control plane
The internal administration surface is deployed separately on port 9443 and restricted by a source-IP allowlist in the production topology.
Attributable operations
Memory evidence preserves actor and source provenance; the internal surface includes role and operational audit boundaries.
02 / CUSTOMER RESPONSIBILITY
The integration still controls what is submitted.
Do not place root keys, passwords, verification codes, or unrelated sensitive content in prompts or source files. Use protected environment configuration and revoke compromised credentials.
Review the account and Codex authorization shown by the app before approving it.
Keep API Keys in trusted server or local environments, never in a public browser bundle.
Use separate project scopes and explicit Agent attribution when several tools share memory.
03 / SECURITY CONTACT
Report a security concern through a tracked request.
Use the official form with a verified work email and include enough detail for the team to reproduce and classify the issue.