Trust

What is true today, stated plainly. We will update this page when it changes.

What is enforced today

• Each agent has its own capabilities and tool grants; changes are admin-only and audited.
• Agent-written memory is a draft until an admin verifies it; instruction-like text is quarantined; every version is kept and can be rolled back.
• Write tools create an approval request and run only after a human approves; secret-looking tools can never be granted.
• A hash-linked audit log records decisions, denials and memory changes. It detects edits; it is not an external signature.
• Access keys are stored as hashes; MCP tokens are encrypted at rest; MCP addresses cannot point at internal networks.
• Security headers, request-size limits, rate limits, readiness checks and online backups.
• An authorization self-test with a shareable evidence report.

What we do not have yet

• No SOC 2 or ISO 27001 report. We are not claiming one.
• No SSO or SAML; access uses tokens with roles.
• No multi-tenant hosting: each customer runs an isolated workspace.
• No independent penetration test report yet.
• Prompt-injection and memory-poisoning detection is pattern based, not semantic.

Your data

Workspace data lives in the database on the host you choose. Prompts go to the model provider you configure, under that provider's terms. This product does not train models on your data.

Sub-processors

Depends on your deployment:

• Your hosting provider
• Your model provider (an OpenAI-compatible endpoint or Hugging Face Inference Providers)
• Stripe, only if you enable paid plans
• Brave Search, only if you enable web research
• The Simple Icons CDN for app logos, which you can switch off

Security contact

Security questionnaire

We keep pre-written answers for common buyer questionnaires based on what the product does. Ask for them in a pilot request.

Back to the overview