Security Guide

This guide addresses security considerations throughout your journey with Pipecat Cloud, from account creation to running production agents. Each section focuses on practical security measures you can take and explains how Pipecat Cloud protects your agents.

​

Account & Organization Security

​

How do I secure access to my Pipecat Cloud account?

Pipecat Cloud implements different authentication mechanisms depending on how you interact with the platform:

​

How do I manage access for my team?

Organizations provide a secure way to collaborate with team members:

• Create separate organizations for different teams or environments
• Invite members with appropriate permission levels
• Use organization-specific API keys for automation

Each organization has its own isolated environment with separate resources, agents, and secrets.

​

Development Security

​

How do I keep API keys and secrets secure during development?

Never include sensitive credentials in your agent code or images:

# DON'T do this
api_key = "sk_1234567890abcdef"  # Hardcoded keys are a security risk

# DO this instead
import os
api_key = os.environ.get("SERVICE_API_KEY")  # Use environment variables

During local development, use environment files (.env) and ensure they’re in your .gitignore.

For deployment, use Pipecat Cloud’s secrets management:

# Create a secret set with your API keys
pcc secrets set my-agent-secrets \
  OPENAI_API_KEY=sk_... \
  ANTHROPIC_API_KEY=sk_...

# Reference in deployment
pcc deploy my-agent my-image:latest --secret-set my-agent-secrets

​

Is my agent code secure during development?

Your local development environment and version control security are your responsibility. We recommend:

• Using private repositories
• Implementing branch protection
• Scanning code for security issues
• Never committing secrets or credentials

​

Deployment Security

​

How do I secure my agent container?

Follow these container security best practices:

1. Start with our official base image for a pre-hardened configuration
2. Include only necessary components to reduce attack surface
3. Keep dependencies updated to patch vulnerabilities
4. Use container scanning tools before deployment

​

Are my private container images secure?

If you use private container registries, Pipecat Cloud supports secure image pulls:

# Create an image pull secret for private registry
pcc secrets image-pull-secret dockerhub https://index.docker.io/v1/

# Alternatively, use base64 encoding for credentials
pcc secrets image-pull-secret dockerhub https://index.docker.io/v1/ --base64encode

# Use it during deployment
pcc deploy my-agent my-private-repo/image:latest --credentials dockerhub

Credentials are securely stored and only used during image pulls.

​

How does Pipecat Cloud protect my agent code?

Your deployed code remains private and protected through multiple layers:

• Containers run in isolated Kubernetes pods
• Network policies restrict cross-agent communication
• Each organization has separate namespaces
• Access controls prevent unauthorized access to running containers

​

Runtime Security

​

Can other customers access my agents or data?

Pipecat Cloud implements strong multi-tenant isolation:

• Organizational namespacing creates logical boundaries between customers
• Network policies prevent cross-namespace communication
• Kubernetes RBAC controls limit access to running pods
• Authentication is required for all API access

​

How are my agents protected at runtime?

Pipecat Cloud provides several runtime security measures:

• Network Controls: Restrict egress to necessary services
• Access Monitoring: Track authentication and access patterns
• Secret Injection: Environment variables for secure credential access

​

Who can start sessions with my agents?

Only clients with valid API keys for your organization can start agent sessions. For security best practices:

1. Use server-side code to start agent sessions, keeping API keys secure on your server
2. Never expose API keys in client-side code

# Create a public API key for client applications
pcc organizations keys create

# Associate with specific agents
pcc organizations keys use

We recommend implementing a server-side endpoint that starts sessions on behalf of your users, similar to how you might handle other sensitive API operations.

​

Data Security

​

Is my data encrypted?

Pipecat Cloud encrypts your data throughout the platform:

• In Transit: TLS 1.3 encryption for all API communications
• At Rest: AES-256 encryption for stored data
• Database: Hardware-level encryption for database content, such as public API keys which developers control the rotation of

​

Where is my data stored?

All Pipecat Cloud infrastructure is currently located in the US (AWS us-west-2 region). Contact us at help@daily.co if you have specific data residency requirements.

​

What happens to my data when agents terminate?

Ephemeral data used during agent sessions is removed when the session ends. By default, stdout and stderr logs are stored in Pipecat Cloud. You have control over what is logged and where the logging is stored. Refer to Logging & Observability for more information.

​

Monitoring & Incident Response

​

How does Pipecat Cloud detect security issues?

We maintain comprehensive logging and monitoring:

• Administrative API calls are logged and retained for 1 year
• Authentication attempts and access patterns are monitored
• System events are tracked for security analysis

​

How do I report security vulnerabilities?

If you discover a potential security vulnerability:

1. Email us at disclosures@daily.co (we’ll acknowledge within one week)
2. Provide reasonable time for us to resolve the issue before disclosure
3. Make a good faith effort to avoid violating privacy or degrading service

​

Security Responsibilities

Security in cloud environments works best as a partnership. Pipecat Cloud follows a shared responsibility model where we secure the underlying infrastructure and platform, while you maintain responsibility for your application code and configuration. Understanding these boundaries helps ensure comprehensive protection for your agents and data.

​

What security aspects does Pipecat Cloud handle?

Pipecat Cloud is responsible for:

• Infrastructure and platform security
• Network security and isolation
• Secret storage and injection
• Authentication systems
• Platform monitoring and logging

​

What security aspects am I responsible for?

As a customer, you’re responsible for:

• Application code security
• API key management
• Agent configuration security
• Following container security best practices
• Proper secrets management

​

Additional Resources

For security-related questions or to report security issues:

• Security Issues: Email disclosures@daily.co to report potential vulnerabilities
• General Support: Contact help@daily.co for security questions