Self-hosted AI agents, in production · installs in fifteen minutes
Rikoo
ENFRES
 Install

Safe by construction, not by instruction.

An agent that can read documents, call tools and answer strangers is a new kind of attack surface. Telling the model to be careful is not a control. These are the controls.

Read about guardrails Data processing
0
Data sent to the vendor
1
Sandbox per run
Air-gap
Supported deployment
Append-only
Audit log
Containment

What an agent can reach, and what it cannot.

  • One sandbox per run

    The embedded servers execute in a workspace created for a single run and destroyed with it, under a dedicated system identity. There is no path from one run into another, and the shell has no network at all.

  • Every outbound call is guarded

    Anything leaving the platform passes an anti-SSRF guard that refuses addresses resolving onto internal networks. The browser in the sandbox imports the same guard rather than a copy of it.

  • Untrusted content is framed

    Attachments, retrieved extracts, tool output and MCP server descriptions are framed as data before they reach the model. This is the defence against indirect prompt injection, and it has one implementation for the whole platform.

  • Secrets are write-only

    Credentials are sealed under an envelope key and never returned by any endpoint. The API server never decrypts them; only the worker does, only in the stack of an outgoing call, and every access is audited.

  • Tenancy is structural

    Every query on tenant data goes through a client that requires an organization identity. Cross-organization reads are not a permission that can be misconfigured: the code path does not exist.

  • Nothing sensitive in the logs

    No secret and no conversation content in the diagnostic logs, and a media file never enters the run journal as bytes, only as a pointer. The same rule applies to traces, where content capture is off unless an operator turns it on.

Identity and access

Sessions that cannot be stolen from storage

Studio sessions are opaque: a random identifier stored hashed, in a host-scoped, HTTP-only cookie. There is no token in browser storage and no long-lived credential for a human.

  • Double expiry: eight hours of inactivity, thirty days absolute
  • Rotation on any privilege change, and immediate revocation
  • Argon2id password hashing with progressive lockout, and two-factor with recovery codes
  • Single sign-on over OIDC and SAML, per organization, with verified domains (Enterprise)

Roles and permissions

Proof, not promises

The invariants are enforced by the build, not by review.

The rules above are not conventions the team tries to remember. Each one has a check that fails the build when it is broken: module boundaries, the ban on raw database clients, the ban on outbound calls from the API server, the ban on visible text without a translation key.

The parts that carry the most risk carry the most tests: crash and replay on the run engine with no duplicate effect, cross-collection and cross-organization tightness on retrieval, a table-driven permission matrix, and deletion leaving no orphan in the database or in object storage.

Frequently asked

What a security review usually asks.

Do you see our data?

No. The platform runs on your infrastructure and reports nothing back to us. There is no usage telemetry, and a fully disconnected install is a supported deployment.

Where do our credentials live?

In the vault on your instance, encrypted under a root key you generate and hold. We never have it. Rotate a credential and the old value is superseded; nothing has to be re-entered elsewhere.

What stops an agent reading another team's documents?

Retrieval takes the granted collections as an argument and filters on them inside the SQL query. Grants are frozen when a run is created, so widening an agent mid-conversation does not widen a run in flight. Both boundaries are covered by tests that specifically try to cross them.

What happens if a document tries to give the agent instructions?

It is framed as untrusted content before it reaches the model, and guardrails can additionally block or escalate. This is the main defence against indirect prompt injection. It reduces the risk; no one should claim it eliminates it, and an agent exposed to the public deserves the stricter templates.

Can we get an audit trail?

Yes. The audit log records who did what: a version published, a grant changed, a secret accessed, a member invited, a key revoked. It is append-only, and extended retention and CSV export are Enterprise.

Do you have a certification?

Not today, and we would rather say so than imply otherwise. What we can give a reviewer is the architecture, the invariants, the threat models written for each sensitive area, and the source of the core.

Send us your security questionnaire.

We answer from the architecture rather than from a brochure, and we say what is not covered.

Contact us Read the data processing terms