Enterprise security, stated plainly

No certification badges yet. Here is what is in place today, what is on the roadmap, and what we will not claim until the evidence exists.

In place today

  • Tenant access checks that fail closed

    Every API route requires a signed-in session by default. A fixed list of exceptions, such as webhooks, scheduled jobs, API-key routes and sign-in callbacks, uses its own checks instead. Tenant and org access checks fail closed where a route uses them.

    A CI ratchet stops the count of routes without a per-route tenant guard from growing, and cross-tenant regression tests run on every merge.

  • Vault credentials encrypted at the field level

    Credentials added in an Org's credentials settings, and webhook secrets, are encrypted with AES-256-GCM under a key held outside the database. Some connection tokens are not in the vault yet; moving them is under way.

    Restricted API keys are stored as hashes and shown once at creation.

  • Human control over agent autonomy

    Each Org holds a custody level from shadow to autonomous, set when it is created. A listed set of outgoing actions is checked against that level before it runs, and below it the action waits for a human. Not every outgoing path passes this check yet.

    By default, the planning cycle stops an Org's model calls once a daily or monthly spend cap is reached; some chat and email sessions are not checked against it yet. The working level can drop for a cycle after a model swap or a run of escalations.

  • A compliance boundary checked before execution

    Tenants can declare a compliance boundary: which model endpoints, connectors, regions and egress routes are allowed.

    When a boundary is set, the planning cycle checks it before each action it takes and denies when the posture cannot be resolved. Workflows, procedure runs and the newer runtime do not run this check yet.

  • Untrusted input treated as data

    Inbound email is first digested as content without a model reading it as instructions. A later model session that reads mail runs at monitor level and cannot send.

    Turn-forgery cases are covered by regression tests.

  • Change control with provenance

    The main branch is protected, required checks gate every merge, and every pull request carries a session provenance trailer.

    Deploys pin a commit and roll back by hash.

On the roadmap

Planned work. No dates are promised until the evidence exists.

  • SOC 2 Type II: a Type I report first, then a six-month Type II observation window. Programme being scoped.
  • Single sign-on (SAML and OIDC) and SCIM provisioning on the Company tier.
  • Tenant audit-log export with 12-month retention.
  • ISO 27001:2022 after SOC 2, for UK and EU procurement. Cyber Essentials Plus in the interim.
  • ISO 42001 AI management system: documented first, certified after.
  • Independent penetration test, with a shareable summary.
  • EU AI Act Article 50 disclosure on every agent-authored email and message.

What we will not claim

  • We do not say SOC 2 compliant or ISO certified until a report or certificate exists. SOC 2 is an attestation; nobody is "SOC 2 certified".
  • We do not say HIPAA-aligned or PCI-aligned. The platform is not authorised for protected health information or cardholder data today, and no business associate agreement is offered.
  • We do not say "no data leaves your tenant". Sub-processors, including model providers, are listed in the privacy policy with 30 days notice before changes.

Data handling

  • Retention periods for the main data classes are published in the privacy policy. On account termination or a valid request, data is deleted or anonymised within 30 days, subject to legally required retention.
  • UK GDPR and EU GDPR rights are honoured, with the ICO as the UK supervisory authority.
  • The web tier runs in London (Vercel lhr1). Database and worker regions are documented on request.
  • Model providers used today are Anthropic and OpenAI, named in the privacy policy.

Documents and requests

Security questionnaires (SIG Lite, CAIQ) and a security overview are answered on request through the enterprise contact form.

Found a security problem? Email legal.orgs-ai@inbox.orgs.ai. Please do not report it in a public GitHub issue.

Last reviewed 2026-10-29. This page states current posture; it is not an audit report.