Security: controls and deployment boundaries

RefreshList separates customer workspaces from administrator operations and checks access on the server. The current private review uses hosting-platform ChatGPT sign-in, protected workspace downloads, and encrypted provider credentials. This page distinguishes implemented controls from requirements awaiting public-launch setup, without implying unverified certifications, independent audits, or a blanket security guarantee.

Last updated 2026-09-14. Read the scope and limitations before applying a result.

Key points

Administrator access is server-enforced.
Secrets stay off the browser.
Public authentication still requires integration.

Detailed explanation

Uploaded objects are accessed through authorized workspace routes. Provider credentials are encrypted by the app. Account permissions and bearer API keys must each be managed deliberately.

Example

Opening the admin URL does not grant a normal customer administrator privileges.

How RefreshList handles it

Operations are separate at /admin. Suspending a user does not replace revoking an exposed workspace API key.

Limitations

No SOC 2, ISO, independent penetration test, or security SLA is claimed. Deployments outside the trusted host need proper authentication replacement.

Methodology and sources

Product behavior is described from the current RefreshList implementation and provider contract. Protocol context should be checked against the applicable standards and provider documentation. This page does not create a benchmark or certification.