Security posture.
Our products exist because agent workloads should not run on trust. The same principles apply to how we build and operate.
Design principles.
These are engineering commitments, not compliance claims. We state what the systems are built to do and where the boundaries sit.
Isolation by default
Agent workloads run inside explicit execution boundaries with narrow permissions and bounded resources — never as trusted code on a shared host.
Identity over network trust
Services and workers authenticate with per-workload identity. Reachability is never treated as authorization.
Your boundary, not ours
Products are designed to deploy inside customer infrastructure. Data, policies, and runtime stay within the environment you already govern.
Auditable operation
Runs leave durable records — events, artifacts, and decisions — so what a system did is a matter of inspection, not recollection.
This website.
The public site follows the same discipline as the products.
Static and minimal
The site is static, collects no form data, and sets no tracking cookies. The only third-party request is privacy-preserving Cloudflare analytics.
Hardened headers
Content-Security-Policy, HSTS, frame denial, and restrictive permissions policies are set on every response.
Reporting a vulnerability.
If you believe you have found a security issue in our products or this site, email us with reproduction details. We read every report and will respond.