Security is the product

We sit between your agents and your most sensitive systems. This page explains the controls that make that safe, and how to get the evidence your auditors need.

Compliance status

SOC 2: Controls mapped to the Trust Services Criteria; report status on request
GDPR: Data processing agreement available for all paid plans
Penetration testing: Annual third-party test; summary available under NDA

Identity and access

SSO via SAML and OIDC; SCIM directory sync for automatic provisioning
Offboarding revokes membership, tokens, direct grants and team memberships in one code path
Access tokens are stored as SHA-256 hashes, expire within 90 days and die with the membership

Operators wearing headsets work a row of switchboard positions — Operators at the Victory switchboard, Potsdam Conference, 1945.

Guard rules and approvals

Natural-language rules are evaluated by a classifier before every action
Enforcing guards fail closed: if the classifier is unavailable, the action is denied
Sensitive actions can require approval, and nobody can approve their own request

Agent action

VerdictDeniedRule q3-reports matched

ClassifierOnline

Tamper-evident audit log

Append-only and hash-chained per organisation, with writes serialised by a single writer
Records tool calls, grant changes, guard decisions, sign-ins and admin actions
Export to your SIEM or object storage; secret values never appear in audit data

Audit log · acmeChain verified through #1042

#1041grant.createdallowed
admin@acme.example · team:billing → billing-api (read)
prev 9f2c0b6d…a71ehash f8a4beb2…14cc
#1042mcp.tool_calledallowed
dana@acme.example · github.search
prev f8a4beb2…14cchash 8aedf067…505d
#1043policy.denieddenied by q3-reports
dana@acme.example · files.delete reports/q3/summary.pdf
prev 8aedf067…505dhash 6a5654ce…a57d
Written from your edit

Encryption and secrets

TLS 1.2+ in transit; data encrypted at rest by the platform
Secrets are envelope-encrypted with AES-GCM; data keys are wrapped by a key-encryption key
Plaintext secrets are never stored, logged, returned by the API or exposed to agents

A round steel vault door on heavy hinges, standing open in a stone hall — Vault door, Bowery Savings Bank, New York, 1923.

Infrastructure and residency

Runs on Cloudflare Workers, D1, KV, R2 and Durable Objects
Regional data placement available for Enterprise customers
Least-privilege production access, reviewed quarterly

A technician on a step reaches into tall racks of telephone relays — A technician at the switching frame, Helsinki, 1968.

Subprocessors

Cloudflare	Hosting, storage and AI inference
WorkOS	Authentication, SSO and directory sync

Report a vulnerability or request documents

Email our security team for responsible disclosure, our security questionnaire, or the latest compliance reports.

security@smartplane.dev

Contact security