Not a policy doc. Architectural. SOC 2 Type II, ISO 27001, region-pinned residency, immutable audit log on every action — agent or human.
Each layer of the platform — identity, encryption, residency, audit, sub-processors — is a deliberate architectural choice, not a checkbox. Every agent or human action passes through all five and is signed into the audit log before it commits.
AES-256 at rest, TLS 1.3 in transit. HSM-managed keys. Customer-managed keys (BYOK) on Enterprise.
Okta, Azure AD, Google Workspace, OneLogin SSO. Row-level RBAC, scoped API keys.
Every action — agent or human — logged, signed, queryable via API for SOC 2 audits.
Region-pinned in US, EU, MENA, APAC. Data never leaves your region without explicit approval.
Public, versioned list. 30-day notice on changes.
Documented IR plan, 72-hour notification commitment, public postmortem within 14 days.