AI designs. People approve. Only the approved version runs.
Someone in your company wants to use Liitora to connect two systems. This page tells you what that means for your security. It takes two minutes to read.
What the AI assistant can and can't do
People connect their own AI assistant (Claude, ChatGPT, GitHub Copilot or another MCP client) with their own sign-in. Liitora has no AI of its own.
It can
- Write workflow drafts and their tests
- Run those tests against fake answers
- Read run logs and explain failures
- Ask a person to add a secret, through a link
It can't
- See a secret value
- Approve a version
- Create API tokens
- Reach a system the workflow doesn't declare
- Turn a workflow on, unless an admin allows that for that one workflow. The workflow then shows it.
How a change goes live
- The AI saves a draft. A draft never runs in production.
- Its tests must pass, in a sandbox against fake answers. No real system is touched.
- A person approves that exact version. They see what it does in plain English, the change, and every connection and secret it uses, with new ones marked.
- Liitora runs only that version, in a sandbox, through one fixed outbound address you can allow in your firewall.
Who approves. The author of a version can't approve their own. By default, the person who asked the AI may approve its work. To make sure someone else always approves, an admin turns on Always require a second approver. Use it when the approver must be independent of whoever asked for the change. Who may approve
Why it can't run loose
When AI agents cause damage, it is usually the same story: the agent held live keys, decided what to do while it ran, and nobody approved the step. Liitora takes away all three.
The AI never holds the keys
Only people handle secret values.
- Values live in a dedicated secret store (OpenBao), per company
- Masked in logs, outputs and errors
- Showing one needs a permission and is logged first
What runs is fixed
The approved version runs as written.
- Scripts run in a WebAssembly sandbox with no file system or network of their own
- HTTPS to public addresses only. Private and cloud metadata addresses are blocked.
- The approved version is checked again before every run
You can prove it
Every change and every run is recorded.
- An audit log that can't be edited
- Run logs with every step, secrets masked
- Export everything as readable files
Questions your auditor asks
Liitora keeps the record. Your compliance team decides what it proves. Collect evidence for an audit
| They ask about | What Liitora does | Your evidence |
|---|---|---|
| Change management (DORA ICT change rules, NIS2) | Every version is kept. Someone who is not the author approves it. With the second approver setting, it is never the person who asked for it either. | Approvals and version history in the audit log |
| Access and least privilege | Each workflow declares the connections and secrets it may use. Calls to anything else are refused. Only people handle secret values. | The connections and secrets on every version, and refused calls in the audit log |
| Logging and monitoring | Every run is logged step by step. Failures and late syncs raise alerts. | Run logs, incidents and alerts |
| Human oversight of AI | AI designs, people approve. AI steps inside a workflow run only if you add one, are marked, are confirmed by the approver, and can be turned off for the company. | The approval record and the audit log |
| Data location (GDPR) | Hosted by UpCloud in Helsinki, Finland. Each workflow shows where its data goes. | The DPA and the list of subprocessors, published before launch |
What Liitora doesn't do for you
We would rather you hear it from us.
- An approver who doesn't read approves anything. We make each approval readable. Making sure people read is yours.
- A wrong workflow that someone approved still runs as written. Fixed runs make it predictable, not correct. Tests and review catch most mistakes, not all.
- An AI assistant can be misled while it designs, for example by text it reads. That is why the change and everything it can use are shown before approval.
- Liitora holds your connection secrets. They are encrypted, masked and used only for the workflows that declare them. Rotate them as you would anywhere.
- AI steps, if you add them, can answer differently between runs. Turn AI steps off for the company if you need every run fixed.
- We are not ISO 27001 or SOC 2 certified yet. The security overview describes every control, and we answer your security questionnaire.
Stop it at any time
- Pause a workflow: no new runs start.
- Revoke an API token: it stops working at once. API tokens
- End the AI assistant's access: it has no long-lived access and stops when the person's sign-in ends.
Each of these is recorded in the audit log.
Who is behind it
Liitora is founded by Matti Lehmus, co-founder of Feedtrail and its Head of Integrations from 2015 to 2022. With major US health systems, his team took on one of HL7's biggest gaps, its missing security, and built an end-to-end encrypted integration layer with fully isolated customer environments. Feedtrail was named Best in KLAS 2024 and acquired by Relias in 2025.
That layer cut the cost of setting up a hospital's integration from tens of thousands of dollars to about $50 a month, and made near real-time patient feedback possible, such as a survey by text message after surgery. Liitora brings the same rule to every company: an integration must be secure by design, not secured afterwards.
Liitora Oy is a Finnish company. Liitora's own security is what this page and the security overview describe.
Next
- Security overview: hosting, isolation, sign-in, secrets, the sandbox and how we build it
- Where your data goes
- AI in workflows
- The DPA and the list of subprocessors: published before launch
Questions from your security review? Write to hello@liitora.com. Please don't send secrets.