Security

Security posture for the connector, data, and action layer.

The system should protect the site connection, the control plane, and the decision trail with the same seriousness it gives to recovery.

Yes
Signed actions
Short TTL and scoped
Per site
Connector scope
No shared secret
Append-only
Audit
Reviewable evidence
Controls

The main security boundaries

These are the layers that keep trust intact when WordpexAI touches a production workflow.

Connector

Per-site credentials

Each WordPress site gets its own connector token and secret exchange, rather than sharing a global secret.

Signing

Signed actions

Action requests are scoped, time-limited, and verified before anything executes on the site.

Audit

Immutable trail

Critical events, approvals, and outcomes are logged so teams can review what happened and why.

Data

Least necessary retention

Store the operational context needed to make safe decisions without keeping more than the product needs.

Practices

What good security should look like here

The website should make the product’s boundaries obvious before a customer asks.

Connector protection

  • One connector per site
  • Single-use pairing exchange
  • Signed heartbeat transport
  • Replay protection and timestamp checks

Execution protection

  • Policy review before action
  • Approval gates for risky changes
  • Rollback readiness visible before execution
  • Audit events for proposals and outcomes
Incident response

If something looks wrong, the product should get quieter, not bolder

Security work should reduce the blast radius before it increases the pace.

Detection

Identify the issue

A risk signal, a failed verification step, or a connector anomaly triggers the security review path.

Containment

Isolate the action

High-risk operations pause behind policy until the right approval or rollback readiness is visible.

Review

Check evidence

The audit trail and connector context show what happened, who approved it, and what was executed.

Recovery

Restore control

If remediation fails, the platform falls back to the safest documented recovery path available.

What buyers care about

Security is partly a product promise and partly a proof problem

The page should make it easy to see how the system behaves under pressure.

Role-based access

Only the right people should be able to approve or observe sensitive actions.

Scoped data

Operational context should be enough to support decisions without becoming a liability.

Reviewability

If a customer asks what happened, the answer should be in the audit trail, not an email chain.

Want a closer look at the safety model?

Read the docs, run a scan, or talk to sales about the controls you need to see in production.