Enterprise‑grade Security, Built In
Keep your data safe while you move faster. Every agent is scoped to what it's allowed to do, every run is logged, and risky actions wait for a human.
Trust Center
Controls, audit status, and documentation. All public.
Runtime Evidence
Live evidence of production AI agents, including every tool call, governance decision, policy evaluation, and enforcement.
How agents work safely
Controls sit on the agent itself: what it can reach, what it can pass, and what it has to ask about first.
If an agent is told to do something it shouldn't
Content an agent reads can try to give it new instructions. That is prompt injection, and no vendor can promise a model will never fall for it. What we can do is bound what happens next. An injected instruction cannot hand an agent a tool outside its allowlist, an argument value outside the restrictions, an action past approval, or a route to an internal address. Every control below applies the same way whether the instruction came from your team or from a page the agent opened.
Tools are allowlisted per agent
An agent can only call the tools it was explicitly given. Remove one and it's gone from the next run.
Restrictions on tool arguments
Pin the values a parameter may take: exact values, wildcard patterns, or both. Checked on our side before the call leaves our perimeter.
Approval before sensitive actions
Reads and reversible edits run on their own. Anything that leaves your workspace or can't be undone waits for a person.
Access is inherited, never granted
An agent works through the connection of the person who set it up. Revoke their access and the agent loses it too.
Secrets the model never sees
An agent refers to a secret by name only. The value is filled in on our side at call time, so it never reaches the model or the transcript. At rest it is encrypted and bound to its owner, so a row lifted into another account fails to decrypt.
Agent‑chosen URLs are checked
Where an agent picks the address to fetch, the request is checked before it goes out: http and https only, never a private or internal address, with limits on redirects, time, and response size.
Inbound triggers are verified
A webhook is how an agent gets started, so every inbound trigger is signature‑checked against the raw request before anything runs.
Every run and every tool call is recorded
Each run stores what the agent decided, which tools it called, with which arguments, and what came back.
Change history on every agent
Instructions, tools, and restrictions are versioned. See what an agent looked like at any point, and roll it back.
Your data stays yours
Customer data is never used to train any models.
Deploy in your own infrastructure
Enterprise add‑on: on‑premise deployment in your own VPC, with your own model providers.
What an argument restriction looks like
A recruiting agent with access to email and Slack, restricted so it can only ever write to the people and places you picked:
- Send email → the
tofield must match*@yourcompany.com - Post to Slack → the
channelfield must be#hiring
A call outside those values never executes. The agent is told the call was refused and that it should not look for another route to the same action.
How we protect your data
Encryption by default
TLS in transit and strong encryption at rest. Integration credentials and stored secrets get a second layer on top: AES‑256‑GCM applied by the application, with the key held outside the database, so a database dump on its own yields ciphertext.
Least‑privilege access
Role‑based controls, with least privilege as the default. Every query is scoped to the signed‑in user, and row‑level security in the database sits behind that as a second line.
Monitored & tested
Continuous monitoring, internal reviews, and regular security testing.
Resilient by design
Isolated production, routine backups, and tested recovery procedures.
Logs that don't carry your data
Logs and error reports pass through one redaction layer that strips credentials and personal data. Background jobs carry record IDs only, never message content.
Policies & processes
Data management
Classification, protection, retention, and deletion aligned to business and legal needs.
Access control
Role separation, least‑privilege by default, and periodic access reviews.
Incident response
Preparedness, detection, escalation, and post‑incident reviews with playbooks.
Vulnerability management
Routine patching and remediation with risk‑based prioritization and tracking.
Vendor risk
Security evaluation of critical third‑party providers and ongoing oversight.
Compliance
SOC 2 Type II
Audit in progressOur SOC 2 Type II controls are already being met, and the audit is currently in progress. The control list and the audit engagement letter are public in our Trust Center.
GDPR
ReadyA signable DPA, a published sub‑processor list, consent records with full history, and self‑serve export of your data as a single archive. Error reports are dropped for users who have not consented to them. Deleting an account erases its content permanently after a 30‑day grace period; financial records are anonymized rather than removed, because tax law requires keeping them.
We align our controls to the Trust Services Criteria and build the evidence required for independent assessment.
Report a vulnerability
Found a security issue? We welcome reports from researchers and will work with you to resolve confirmed vulnerabilities. Email[email protected]and review our coordinated disclosure policy before testing.
Read our Vulnerability Disclosure PolicyBuilt for trust, improving every day
We regularly review controls, invest in monitoring and automation, and share updates as we grow.
Disclaimer: This page is for informational purposes only and does not create any legal obligations, warranties, or commitments.