Enterprise security, stated plainly
No certification badges yet. Here is what is in place today, what is on the roadmap, and what we will not claim until the evidence exists.
In place today
Tenant access checks that fail closed
Every API route requires a signed-in session by default, and tenant and org access checks fail closed where they apply.
A CI ratchet stops the count of routes without a per-route tenant guard from growing, and cross-tenant regression tests run on every merge.
Credentials encrypted at the field level
Stored org credentials and webhook secrets are encrypted with AES-256-GCM under a key held outside the database.
Restricted API keys are stored as hashes and shown once at creation.
Human control over agent autonomy
Agents hold a custody level from shadow to autonomous and are promoted only on evidence. Irreversible actions route to a human checkpoint.
A hard-stop spend cap applies per org, and autonomy is demoted automatically on model swaps and failures.
A compliance boundary checked before execution
Tenants can declare a compliance boundary: which model endpoints, connectors, regions and egress routes are allowed.
When a boundary is set, the runtime checks it before every action and denies when the posture cannot be resolved.
Untrusted input treated as data
Inbound email is digested as content, not executed as instructions.
Prompt-injection and turn-forgery cases are covered by regression tests.
Change control with provenance
The main branch is protected, required checks gate every merge, and every change carries a session provenance trailer.
Deploys pin a commit and roll back by hash.
On the roadmap
Planned work. No dates are promised until the evidence exists.
- SOC 2 Type II: a Type I report first, then a six-month Type II observation window. Programme being scoped.
- Single sign-on (SAML and OIDC) and SCIM provisioning on the Company tier.
- Tenant audit-log export with 12-month retention.
- ISO 27001:2022 after SOC 2, for UK and EU procurement. Cyber Essentials Plus in the interim.
- ISO 42001 AI management system: documented first, certified after.
- Independent penetration test, with a shareable summary.
- EU AI Act Article 50 disclosure on every agent-authored email and message.
What we will not claim
- We do not say SOC 2 compliant or ISO certified until a report or certificate exists. SOC 2 is an attestation; nobody is "SOC 2 certified".
- We do not say HIPAA-aligned or PCI-aligned. The platform is not authorised for protected health information or cardholder data today, and no business associate agreement is offered.
- We do not say "no data leaves your tenant". Sub-processors, including model providers, are listed in the privacy policy with 30 days notice before changes.
Data handling
- Retention periods for the main data classes are published in the privacy policy. On account termination or a valid request, data is deleted or anonymised within 30 days, subject to legally required retention.
- UK GDPR and EU GDPR rights are honoured, with the ICO as the UK supervisory authority.
- The web tier runs in London (Vercel lhr1). Database and worker regions are documented on request.
- Model providers used today are Anthropic and OpenAI, named in the privacy policy.
Documents and requests
Last reviewed 2026-09-08. This page states current posture; it is not an audit report.