We sit in the path of every tool call your agents make. That earns you a straight answer about where we run, what we keep, what happens when we fail, and how the numbers on the rest of this site were measured.
Anything that enforces inline is a new dependency in your critical path. Pretending otherwise is how vendors lose security reviews.
So the behaviour is yours to choose, per workspace and per rule. Here is exactly what happens either way.
Most teams run fail open on read paths and fail closed on anything touching money, PII or production writes. The setting is per rule, not per account, so you don't have to pick one posture for everything.
Payload capture is off by default. Turning it on is a deliberate, logged decision that a named administrator has to make, per workspace.
A performance claim without a methodology is a marketing claim. These are the definitions we'll be held to.
Measured at the enforcement layer: the time between an agent emitting a tool call and that call being released or held. It excludes network time to your own systems, because that isn't ours to claim.
Rolling 30 days, every production workspace, all rule types pooled. Not a benchmark run on our own hardware.
Rolling twelve months on the enforcement path — the component your agents actually depend on. Scheduled maintenance is included, not excluded, because an agent blocked during a maintenance window is still blocked.
The console and reporting layer are measured separately and don't sit in your critical path.
Risk scoring holds fire until an agent has 50 completed runs behind it. Before that you get traces and your own rules, but no drift score — a baseline from six runs is noise wearing a number's clothes.
Default 24 months, configurable from 30 days to 10 years per workspace, in the region you pick. Deletion is real deletion, propagated to backups within 35 days.
The hash chain survives payload deletion, so an expired record can still be proven not to have been altered.
Support access is off until you grant it, scoped to a workspace, time-boxed, and written to your audit trail rather than only ours. You can watch us look.
The evidence Spectre holds is exactly the evidence you'd need if Spectre stopped existing. So it streams to your own bucket as it is written — continuously, not on request — and the hash chain can be verified with a published tool that needs no Spectre account to run.
On termination: 90 days of full console access, then a final export. The enforcement layer can be self-hosted, so a lapsed contract never stops your agents.
A penetration test each year across the enforcement path, the console and the public API, run by a firm with no other relationship to us. The summary is available under NDA and includes what they found, not only that they looked.
Each report names the firm, the dates and the time taken to close every finding. A summary that omits the findings isn't a summary.
Cloud infrastructure for the control plane, transactional email, and error monitoring with payloads scrubbed before they leave your boundary. Enforcement runs in your account, so the component sitting closest to your data isn't on this list at all.
Thirty days' written notice before we add a fourth, and a documented right to object. Current list with legal entities and regions on request.
Write to [email protected] with whatever you have. A half-formed report today beats a polished one next month.
We acknowledge within one business day, keep you updated while it's open, and won't pursue anyone acting in good faith.
We'd rather answer it before a call than during one. Send it over and you'll get it back completed, with the gaps marked as gaps.