Platform · Security

Assume the auditor will ask.

Every design decision starts from the assumption that someone will eventually need to reconstruct exactly what happened, and why. The question is never whether the system was clever. It is whether it was correct, authorised and still explainable months later.

Your data stays yours

Nothing you process is used to train any model, ours or a vendor's. That sits in the contract rather than on a policy page we can quietly revise.

Encryption

AES 256 at rest. TLS 1.3 in transit. Encrypted environment variables, so credentials never live inside a workflow.

Identity and access

SAML single sign on, SCIM provisioning from your directory, enforced multi factor authentication, access by role, and permissions set per connection. Access is granted from the directory you already govern, and revoked there too.

Retrieval that respects permissions

Knowledge answers respect the document permissions each user already holds. An agent cannot surface a file its reader may not open.

Complete audit trail

Every run, input, output, model call, tool invocation and approval is logged and versioned, with retention you configure. You get the run itself, ready to execute again exactly as it happened, rather than a summary of it.

Compliance

Our controls are designed with ISO 27001, SOC 2, the GDPR and the data protection rules of your jurisdiction in mind. Designing against a framework is not the same as holding a certification or an independent attestation, so ask us for the current status of anything your procurement requires. We provide a description of our controls to support your own assessment.