Security questionnaires ask the same questions in a different order. This page answers them once: what we hold, where it runs, who processes it, how long it is kept, how to tell us about a vulnerability, and which compliance claims are true right now rather than planned. When something changes, this page changes the same day. Last reviewed 16 September 2026.
Your agent registers once and holds a signing key, never a platform credential. When it wants to act, it calls the broker with a signed request. The broker checks the agent's status, its grant for that platform and scope, your organisation's guardrails and policy, the grant's expiry, the circuit breaker and, for child agents, the parent's standing. If the rule says a human must agree, the call pauses and the owner approves out of band. Only then is the credential unwrapped in memory, attached to the real request, and dropped. Every decision, allowed, held or refused, writes an audit row.
| Data | How it is handled |
|---|---|
| Platform credentials | Envelope encryption: one data key per credential, wrapped by a per-tenant key. On paid plans the tenant key lives in a hardware security module and never leaves it. On the Free plan the tenant key is derived from a master secret held in the same module; it is isolated per tenant but not a dedicated hardware key. Credentials are decrypted in broker memory at call time only, never logged, never returned to the agent, and deleted when you disconnect the platform. |
| Agent signing keys | Generated on your device. We store the public half only. Published as a did:web document when your organisation opts in. |
| Request and response payloads | Pass through the broker in memory and are not persisted. Requests are screened at the boundary for secrets and unsafe destinations before any credential is touched. On scopes you tag as handling personal data, field-name and pattern-based redaction is applied to responses when your organisation turns it on. |
| Audit rows | Who called, which agent, platform, action and scope, the decision, the policy version that decided it, and a request id. The table accepts inserts only; no path in the product edits or deletes a past row. IP address, user agent and geolocation are recorded only on Enterprise and only after a second opt-in; the agent's session id is recorded on every plan. |
| Owner accounts | Name, email and login events are held by our identity provider. Billing details are held by our payment processor. We never see card numbers. |
Encryption in transit is TLS everywhere, including between our own components. We do not claim end-to-end encryption in the messaging sense: the broker must see the plaintext request to attach the credential to it. The security overview has the key hierarchy in detail.
This is the one place on our site that names vendors, because you need the real names to assess them. Each sub-processor's standard data-processing terms apply. We share customer data with no other party.
| Sub-processor | Purpose | Data it can see |
|---|---|---|
| Vultr (Sydney) | Compute for the broker API and the OAuth token broker | Request bodies in transit; wrapped credentials at rest on the broker's database volume |
| Cloudflare | Ingress to the broker, static hosting for the dashboard, this site and the docs, DNS, edge caching | Request metadata, cached static assets |
| Supabase (Sydney) | PostgreSQL for the audit log, credential metadata and row-level tenant isolation; storage for installer distribution; edge functions | All persisted application data |
| Clerk | Owner identity, sessions, multi-factor authentication, single sign-on federation | Owner email, login events |
| Microsoft Azure Key Vault | Hardware-backed key-encryption keys for paid organisations, and the master secret that Free-plan tenant keys are derived from | Wrapped keys only; never a credential |
| Stripe | Subscription billing and payments | Billing email and payment metadata; no platform credentials |
| Resend | Transactional email: approval notifications, sign-in links, onboarding | Owner email addresses and notification subjects |
| The platforms you connect | Each platform you authorise an agent for receives the calls that agent makes through the broker | Whatever the agent sends to that platform |
The OAuth token broker runs on our own host and is not a third party. We will notify you by email before adding a sub-processor that can see customer data.
Email [email protected] with a clear description of the issue, steps to reproduce or a proof of concept, and any test credentials we should rotate after the report. We acknowledge receipt within two business days and give a triage decision within ten. Critical issues (remote credential exposure, audit-log tampering, authentication bypass) are treated as page-out events.
Safe harbour. Good-faith research that respects user privacy, avoids data exfiltration and reports privately to the address above is welcome and will not be pursued legally or reported to law enforcement. A machine-readable copy of this policy is at /.well-known/security.txt on each of our hosts.
| Framework | Status today |
|---|---|
| SOC 2 | Programme not yet started. The controls that exist as code and CI are documented; the people-and-process controls, an auditor and a platform are the remaining work. Type I is the first target. |
| ISO 27001 | Not certified and not currently planned. |
| GDPR and Australian Privacy Principles | Privacy-by-default design: credentials only, payloads not persisted, personal-data fields opt-in per organisation. A data-processing agreement is available on request. Data residency is Australia for all customers; there is no EU region today. |
| ISO 42001, OWASP NHI and LLM Top 10, NIST AI RMF | Aligned, with a published control mapping. Alignment is our own assessment, not a certification. |
If a competitor's page says "certified" and ours says "aligned", that is deliberate. We would rather you find out here than in the questionnaire.
Security questionnaires, a data-processing agreement, or a walkthrough of the key hierarchy with your security team. Email and we will answer directly, usually the same day.