Trust center
Control before the action. Evidence after it.
This page is written for the person whose job is to find the gap. It is engineer-to-engineer, it uses the real vocabulary, and where we do not have something yet it says so in the first sentence rather than the last. If a line here cannot be demonstrated on a live system in under a minute, tell us and we will remove it.
Model-blind execution
For governed machine work, the model does not receive a credential. Not masked — resolved outside its context.
Most "AI security" is a filter on the way out: the model gets the secret and something downstream tries to scrub it from the transcript. That is a redaction problem, and redaction fails eventually. We removed the problem instead. The planner is never on the same side of the wall as the value, so there is nothing to leak, summarise, or reconstruct.
- A reference, not a secret. A plan carries {{credential.<name>}} tokens. Substitution happens on the executor, after the model is done.
- Authenticate first, generate second. The privileged session exists before the model's step does. The step inherits a connection; it does not create one.
- Typed results on the way back. What returns to the planner is a structured result with named fields, not a raw console transcript that could carry anything a machine happened to print.
- Identifiers are aliased. Hostnames, device ids, IPs, tenant and subscription ids are resolved on the privileged side. The model works against labels.
- Masked everywhere else too. The same rule applies to logs, traces, events, exports and screenshots — because an exfiltration path through a support bundle is still an exfiltration path.
Model-blind execution is about credentials, not about omniscience. The model still reasons over operation context, results and runbook text, and that context is a real surface — it is why results come back typed and why we keep identifiers out of it. See Credential Vault for the checkout mechanics.
Leased privilege
Rights that expire on a clock, not when the task finishes.
There is no standing service account with domain admin sitting behind this product, and there is no shared break-glass credential that a technician passes around. Privilege is minted for one operation against one target, and it is taken back on expiry whether the work is done or not.
-
Request
The operation declares what it needs to reach the outcome. It asks for a capability against a target, not for an account.
-
Policy check
Tenant policy decides whether this class of work, on this class of target, may proceed and whether a human has to say so first.
-
Grant, scoped twice
The lease is bound to this operation and to this target. It is not a role you now hold; it is a key cut for one door and one errand.
-
Work
The connection is authenticated with the leased identity immediately before the step executes. When a technician takes work back from the agent, a fresh lease is minted under their own name — the AI's lease is never inherited.
-
Auto-revoke
Expiry fires on the clock. A lease that outlives its work is a standing privilege with extra steps, so we revoke on time rather than on completion.
Full detail on the lease mechanics is on Just-in-Time Elevation, including the exposure comparison against a standing admin account.
Evidence integrity
A record the recipient can check without asking us.
Evidence you can only verify by logging into the vendor's dashboard is not evidence — it is a claim with a login screen in front of it. The export carries what a third party needs to check it on their own machine.
We will claim exactly this and no more: the chain makes alteration evident across the records you hold. It is not a distributed ledger, there is no third-party notary, and we would rather say that than let the word "immutable" do work it has not earned. See the receipt itself →
Isolation and access
Walls between customers. One rail for every connection.
Per-tenant isolation
Records, evidence and inventory are bounded per tenant, and every read is scoped to the boundary the caller is operating in. Mapping between tenants runs one way only: an MSP primary may reach into its own sub tenants, and any tenant may reach within itself. Sub tenant to primary, and sub tenant to sub tenant, are never permitted — and that rule binds AI actors exactly as it binds people.
Roles & multi-tenancy →The gateway is the only rail
Every connection to a managed endpoint — human or AI, remote desktop or command execution — rides one authenticated multiplexed connection out to the gateway. There is no inbound listener to expose on your side and no second private path for the AI. The gateway re-authors remote input rather than forwarding what a client sent, so a client cannot assert bindings the target has not agreed to.
Governed sessions →On session capture we are deliberately narrow. We describe governed launch, authorization, binding to an operation, and what the operation record carries. We do not claim complete multi-surface session recording and playback, and you should treat any vendor who does as owing you a live demonstration. What is and is not covered →
Data handling
What we hold, where it sits, and what we do with it.
Retention numbers, regions and the current sub-processor list belong in a contract, not in marketing copy that can drift. Ask for the DPA and hold us to it. The plain-English summary is on our privacy page.
Assurance
The controls an audit would sample are the product itself.
Privilege that is leased and expires. Execution the model cannot read a credential from. Verification performed by the machine that changed. A signed record of every one of those facts. Every operation produces the evidence an auditor would otherwise have to go looking for — so assurance here is a query against real operations rather than a sampling exercise once a year.
- The control and the evidence are the same object. There is no separate audit-logging system to fall out of sync with what actually happened.
- No standing privilege to attest to. "Who has admin?" has a different shape here, and the answer is a list of expired leases with names attached.
- Evidence per operation, on demand. Any reference number resolves to a sealed record — who authorized it, what ran, what the target machine confirmed, and the declared undo — exportable for your own reviewers or your client's.
- Questionnaires answered in full. Send your own security questionnaire, a CAIQ or a SIG. We complete them, and we mark an unknown as an unknown rather than as a "compensating control".
What you can verify for yourself, right now
This is the part that should matter more than a badge. All six of these can be done inside a demo, on a machine you control, without taking our word for anything.
-
Watch what the model is actually handed
Ask to see the context a planner receives for a live operation. Check it for a credential value, a real hostname, a device id or a tenant id. If one is there, the central claim on this page is false and you will have found it in four minutes.
-
Ask for a lease and then wait
Have an operation elevate, then watch the rights disappear on expiry rather than on the work finishing. Then try to use them.
-
Break the confirmation
Have the operation succeed, then make the target fail the check anyway. The record should carry the machine's answer, not the AI's opinion of its own work.
-
Take an export away and verify it offline
Leave with a signed export. Check the signature and recompute the chain on your own machine, with no call back to us.
-
Try to edit a record
Alter a sealed operation and re-run verification. Every later record should stop agreeing with it.
-
Put the six tests to us cold
The Verified Operation Spec is vendor-neutral and we published it knowing it would be used on us. Ask all six on the call and watch which ones get a straight answer.
A certificate tells you an auditor sampled a set of controls on a date that has already passed. A demonstration tells you what the system does on your machine today. We would rather you had the second one, and we would rather say that than imply we have the first.
Coordinated disclosure
Found something? Tell us, and we will credit you.
What we commit to
- We acknowledge the report and tell you a human has it.
- We triage it and tell you what we think it is, including when we think it is not a defect.
- We keep you informed until it is closed, and we say when it shipped.
- We credit you by name if you want to be credited, and stay quiet if you do not.
- We do not threaten researchers who act in good faith.
What we ask
- Do not test against another customer's workspace or endpoints. Ask us for one to work in.
- Do not exfiltrate, retain, or publish customer data — a proof of access is enough.
- Do not run availability tests against production.
- Give us a reasonable window before disclosing, and tell us if you need it to be short.
Send it through the contact page on the security and architecture route. It reaches an engineer, not a queue.
Bring the hard questions
Every claim on this page is meant to be attacked on a live system.
Book the review, bring your questionnaire and the finding from your last penetration test, and we will work through them on the call rather than after it.