Trust
An honest account of where security posture stands today.
This page states what is true now and what is planned. We do not claim certifications or compliance standards that haven't been completed.
What we do today
Current practices.
Deployment boundaries
The platform is designed to run inside your cloud account and data boundary rather than a shared environment. See Deployment for the reference architecture.
Access control
Connections use credentials scoped to what a specific agent needs, configured per engagement rather than granted broadly by default.
Logging & traceability
Agent actions, tool calls, policy decisions, and human approvals are recorded in a trace, so a completed workflow can be reconstructed after the fact.
Human review
Actions above a defined risk threshold route to a named reviewer before they execute, rather than completing unattended.
Data handling
Retention, encryption, and processing-location specifics are set per engagement rather than fixed platform-wide — they're confirmed during design and documented before a pilot goes live.
What is on the roadmap
Not yet in place.
- Formal third-party security certification (e.g. SOC 2) — not yet completed.
- Independent penetration testing program — not yet completed.
- Published subprocessor list with update notifications.
- Expanded self-serve documentation for security and compliance reviewers.
Subprocessors & DPA
Who else touches the data.
We don't yet publish a running subprocessor list (see the roadmap above). A data processing agreement is available for engagements that require one — see the DPA page.
Data residency isn't fixed platform-wide — options depend on your cloud environment and are confirmed during design rather than offered as a standing commitment here.
Security review before a pilot?
Bring your questionnaire — a working session is a faster way to work through it than an email thread.