Security
The short version: every agent runs in infrastructure you own, under your access controls, with your data never leaving your environment. Escalation boundaries, audit trails and human approval gates aren’t features — they’re the architecture.
Last updated:
Where things run
- Your cloud accounts. AWS, Azure or Google, provisioned and owned by you. We work inside them under access you grant and can revoke.
- Your data residency. Region is your choice, and we design to it. On-premise and hybrid where regulation or connectivity requires it.
- Your repository. Code lives in your version control. You have it from the first commit, not at handover.
- No shared tenancy. We do not run a multi-tenant platform with your data in it.
Access and least privilege
- Named individuals only — no shared credentials, no service accounts passed around
- Scoped, time-bound access to your systems, reviewed at each phase boundary
- Read-only wherever write access isn’t required — historians and control systems are always read-only
- Access removed at engagement end, and we ask you to verify it
Data handling
- Payment data. Agents never store, log or echo full card numbers, CVV or track data. Authorisation runs through PCI-compliant gateways, which is what keeps the agent out of PCI DSS scope.
- Personal data. Handled under your existing obligations — GDPR, UK GDPR, CCPA, or local equivalent. Agents support access, rectification and erasure requests.
- Prompt and trace data. Observability traces can contain business data, so they’re stored in your infrastructure under your retention policy.
- Model providers. We use enterprise endpoints with training opt-out. We’ll show you the specific terms for whichever provider your build uses.
Agent-specific risks we design against
- 01
Prompt injection. Any agent reading untrusted content — inbound email, uploaded documents, web pages — is exposed. Mitigations are architectural: tool authority is scoped narrowly, destructive actions require approval, and content boundaries are enforced rather than requested in a prompt.
- 02
Over-broad tool authority. The most common real-world failure. Agents get the minimum permissions the workflow needs, and nothing gets a general-purpose write credential.
- 03
Silent failure. An agent that quietly stops capturing is worse than no agent. Gaps alert; they don’t pass unnoticed.
- 04
Data exfiltration through outputs. Agents that draft external communications are constrained on what they can include, and human release is the default on anything customer-facing.
Frequently asked questions
Where does our data live?
In your cloud accounts, under your access controls. We don’t host your agents on our infrastructure and rent them back to you.
What happens to data the agent processes?
It stays in your environment. Retention follows your policy, not ours. Voice transcripts, documents and records are yours to keep or delete.
Can agents act without human approval?
Only within authority you’ve explicitly delegated, and never on financial entries, regulated determinations or safety-relevant decisions. Everything else escalates with full context.
Is there an audit trail?
Every action carries a timestamp, source, confidence score and reasoning trace. That’s stronger evidence than most manual processes produce.
What happens if we end the engagement?
The agents keep running — they’re in your infrastructure. You keep the repository, the evaluation suite and the documentation.
Certifications and reviews
[Current certification position — SOC 2, ISO 27001, penetration test cadence. State honestly, including what is in progress and what is not held.]
We’ll complete your security questionnaire and sit on the call with your security team. If something in this page doesn’t satisfy your requirements, tell us during the audit rather than after.