Security & Trust

Every agent runs in an isolated sandbox. Every run is signed and logged. Every byte is encrypted. Here is how we keep the platform safe.

Security Architecture

Five interlocking modules protect every agent, every run, and every byte of data on the platform.

Agent Sandbox

Every agent runs in an isolated sandbox with configurable permission levels. Full sandbox agents have no file system or subprocess access. Network calls are routed through a controlled proxy with allowlist enforcement.

Three isolation levels: Full, Partial, None
Mount namespace hardening prevents symlink escapes
CPU and memory limits enforced per-run
Network egress restricted to declared integrations

Data Handling

Input data is encrypted in transit (TLS 1.3) and at rest (AES-256-GCM). Agent outputs are scrubbed for PII before storage. Data residency options are available for EU and APAC regions.

TLS 1.3 for all API traffic
AES-256-GCM encryption at rest
Automatic PII detection and redaction
Data residency: US, EU, APAC

Immutable Logs

Every agent run produces a signed log entry. Entries are batched into Merkle trees and roots are published to a transparency log. Any tampering is cryptographically detectable.

Ed25519 signatures on every log entry
Merkle tree batching every 60 seconds
Public transparency log for root hashes
Signature verification in under 1ms

Access Control

Role-based access control with SSO/SAML support. API keys are scoped per-agent and per-environment. Audit logs track every administrative action on the platform.

RBAC with org, team, and user roles
SSO / SAML 2.0 integration (Team+ plans)
Scoped API keys with expiration
Admin action audit trail

Dependency Scanning

All agent dependencies are scanned for known CVEs at publish time and on a daily schedule. Critical vulnerabilities trigger automatic de-listing until patched.

CVE scanning at publish and daily
Integration with NVD, OSV, and GitHub Advisory
Automatic de-listing on critical CVE
Builder notifications with remediation guidance

Compliance

We maintain industry-standard certifications and compliance programs.

SOC 2 Type II

Certified

Annual audit covering security, availability, and confidentiality. Report available under NDA.

GDPR

Compliant

Data processing agreements, right-to-erasure support, and EU data residency option.

Data Residency

US / EU / APAC

Choose where your data is processed and stored. Region lock is enforced at the infrastructure level.

Bug Bounty Program

We run a public bug bounty program through HackerOne. Rewards range from $100 for low-severity findings to $10,000 for critical vulnerabilities in the sandbox or signing infrastructure.

Severity	Reward	Example
Critical	Up to $10,000	Sandbox escape, signing key compromise
High	Up to $5,000	Authentication bypass, data exfiltration
Medium	Up to $1,000	CSRF, SSRF, privilege escalation
Low	Up to $100	Information disclosure, misconfiguration