Trust Centre · Security

Written to answer the questionnaire before you send it.

Every control below is described the way an assessor would want it described: what it is, how it is enforced, and what it does not cover. Where a control is only on certain tiers, the tier is named. Where something is planned rather than shipped, it says planned.

Download the security whitepaper Certification status

Pre-answered CAIQ and SIG-lite are available under the click-through NDA. Last reviewed 14 Aug 2026.

Architecture and tenant isolation

KrewOS separates a Control Plane — identity, catalogue, manifests, policies, evaluations, releases — from an Execution Plane that runs compiled plans and holds run state. Every request carries a tenant context that is resolved at the edge and enforced at the data layer, not in application code that a bug could bypass.

Tenant isolation

Row-level isolation on every table with tenant scoping enforced by the database, plus separate object-storage prefixes with per-tenant encryption context. Cross-tenant queries are structurally impossible, not merely disallowed.

Network segmentation

Private subnets for all data stores, no public database endpoints, egress restricted to an allow-listed model gateway and declared connectors. Administrative access only through an authenticated bastion with session recording.

Execution sandboxing

Generated and custom code runs in ephemeral, resource-capped sandboxes with no ambient credentials, a restricted filesystem and network access limited to declared endpoints. Sandboxes are destroyed after each run.

Secrets gateway

Credentials are injected at the point of call by a gateway process. Keys never appear in prompts, logs, manifests, exports, support tooling or crash dumps, and are never returned by any API.

Compile-time effect proof

Before a release exists, the compiler statically proves that no path runs from untrusted input to an external side effect without an intervening approval gate. If the property fails, there is no release to deploy.

Dedicated options

Cloud Dedicated gives you isolated execution resources; Customer VPC and Private deployment move the Execution Plane into infrastructure you control, with the Control Plane still governing centrally.

Control summary

The scannable version. Availability by tier is stated where it differs.

Domain	Control	How it is enforced	Availability	State
Encryption	In transit	TLS 1.3, HSTS, modern cipher suites only; internal service-to-service traffic mutually authenticated	All tiers	Shipped
Encryption	At rest	AES-256 on all volumes, object storage and backups, with per-tenant encryption context	All tiers	Shipped
Encryption	Customer-managed keys	Your KMS key, revocable; revocation renders tenant data unreadable within the rotation window	Regulated tier	Shipped
Identity	SSO — OIDC and SAML	Domain-based discovery at sign-in; just-in-time provisioning with group-to-role mapping	Professional and above	Shipped
Identity	MFA	TOTP and WebAuthn; enforceable tenant-wide, mandatory for administrator roles	All tiers	Shipped
Identity	SCIM provisioning	User and group lifecycle synchronised from your directory; deprovisioning revokes sessions immediately	Professional and above	Shipped
Access	RBAC and segregation of duties	Role sets aligned to the platform personas; approver cannot be preparer where dual approval is configured	All tiers	Shipped
Access	Privileged access	No standing production access. Time-boxed, four-eyes-approved, ticket-linked, fully session-recorded and surfaced in your tenant audit log	All tiers	Shipped
Access	Support impersonation	Requires explicit tenant consent per session, is read-only by default, is time-limited and appears in your audit trail while it is happening	All tiers	Shipped
SDLC	Code review and branch protection	Two-reviewer requirement on the compiler, the secrets gateway and the policy engine; signed commits; no direct pushes to release branches	n/a	Shipped
SDLC	Dependency and secret scanning	SCA and secret detection on every pull request and nightly on all release branches; critical findings block the build	n/a	Shipped
SDLC	SAST and container scanning	Static analysis on every build; base images rebuilt and rescanned weekly with a 7-day critical patch target	n/a	Shipped
Data	DLP and redaction	Configurable detection and redaction of identifiers before content reaches a model provider, with the redaction map retained inside your region	Professional and above	Shipped
Data	Prompt and output logging controls	Per-project setting for whether prompt and completion bodies are retained; metadata and evidence references are always retained	All tiers	Shipped
Resilience	Backup and restore	Continuous write-ahead archiving with point-in-time recovery; restores rehearsed quarterly and the result recorded	All tiers	Shipped
Resilience	Recovery targets	RPO ≤ 15 minutes, RTO ≤ 4 hours standard; tighter targets available by agreement on the Regulated tier	All tiers	Shipped
Monitoring	Security logging	Centralised, tamper-evident logs with 400-day retention; authentication, authorisation, privileged access and effect execution are all logged	All tiers	Shipped
Monitoring	Anomaly detection on agent behaviour	Alerting on abnormal effect frequency, budget burn and retrieval patterns per crew	Professional and above	Planned Q4 2026
Assurance	Bug bounty	Private programme with invited researchers; public programme deferred until the disclosure process has run a full year	n/a	Private only

Incident response

24h notification

Detect and declare
Automated alerting plus a 24×7 on-call rota. Any suspected incident is declared within 30 minutes of triage rather than after confirmation.
Contain
Credential rotation, session revocation and tenant-level isolation are pre-scripted and rehearsed, not improvised during the event.
Notify
Affected tenants notified within 24 hours of confirmation, with what is known, what is not yet known and what you should do. PDPC notification handled in line with the PDPA where thresholds are met.
Post-mortem
Written, blameless, shared with affected tenants within 10 business days and summarised publicly on the status page.

People and process

Background screening
All staff, pre-employment
Security training
Onboarding plus annual
Secure-coding training
Engineers, annual
Phishing simulation
Quarterly
Access review
Quarterly, evidenced
Device management
MDM, disk encryption, EDR
Offboarding
Access revoked same day
Vendor review
Annual, risk-tiered
Policy set
17 documents, annually reviewed

The full policy index, including which policies are available for review under NDA, ships in the security pack.

Threats specific to agent platforms

Generic SaaS controls do not cover the interesting risks here. These four are where an agent platform actually gets hurt, and each has a structural answer rather than a policy answer.

Risk	Why it is different	Structural control
Prompt injection reaching an external action	Instructions hidden in a retrieved document can attempt to steer an agent into sending, posting or paying	The compiler proves at build time that no untrusted-input path reaches a declared external effect without an approval gate. This is a proof, not a filter, and it is outside the model where injection cannot reach it.
Credential exfiltration through model output	A model that can see a secret can be persuaded to repeat it	Models never see credentials. The secrets gateway injects them at the call boundary; the model receives an opaque reference.
Runaway loops and cost exhaustion	Autonomous retry logic can spend a month's budget in an hour	Loops are bounded at design time and rejected by the editor if unbounded. Soft budget limits degrade model tier or concurrency; hard limits fail closed before spending.
Silent quality regression	A prompt or model change degrades output with no error and no alert	Immutable releases with locked dependencies and evaluation gates that block promotion, plus automatic reversion of autonomy when measured accuracy breaches its bound.

Two honest limits. First, a Customer VPC or Private deployment moves execution into your infrastructure, which means the controls on your side of that boundary become yours to operate — we document the split precisely rather than implying we still cover it. Second, model providers are subprocessors with their own security posture; ours is described here, theirs is named on the subprocessor page.

Get the evidence

Penetration-test summary letter, architecture overview, pre-answered CAIQ and SIG-lite, BCP and DR summary and the insurance certificate, all under a click-through NDA.

Open the document portal

Talk to the people who built it

A technical review with the engineers who wrote the effect compiler and the secrets gateway. Bring your architects and your questionnaire.

Book a technical review