Security
Security is the architecture, not a feature.
AI agents change what an attacker can reach: a document that reads like an instruction, a tool that does more than it should, a key that lives too long. Scalata was designed for regulated work, where those doors are closed by default.
What an agent-era attacker tries
Eight ways in. Each one already answered.
The attack surface of an AI platform is not the attack surface of a website. These are the routes that matter, and the control standing in each one today. Select a route to see how it is closed.
Route 01
Content is read. It is never obeyed.
Everything an agent retrieves is handled as data with a known origin. Hidden text, encoded payloads and look-alike instructions are stripped before a model sees them, and no retrieved content can authorise an action.
Every action, accounted for
If an agent did it, there is a record of it.
Every call an agent makes is logged with the agent's identity, the person who triggered it, the tool it used, what it touched and what decided the outcome. When a question is asked later, the answer is already written down.
Agent identity and triggering user on every call, so a record never has to be reconstructed after the fact.
Writes that paused for a person show who approved them and when. Silence is never an approval.
The same trail your team reads is the one your auditor reads, in a format they can take away.
Agents on a leash
An agent can only do what it was given.
A request from an agent passes five gates before anything happens. Each one is small, deliberate and recorded.
Content from documents, email and the web is data, never instruction.
Each agent carries a named list of tools and scopes. Nothing outside it exists.
Code and tools run isolated, with egress limited to what the task needs.
Every write to a system of record pauses for a person. Reads do not.
Identity, scope, approval and result go to the audit trail.
Data and credentials
Your data stays yours. Keys stay short.
Encrypted everywhere
TLS 1.2+ for everything in motion and AES-256 for everything at rest, including backups and indexes.
Segregated environments
Each customer runs in its own segregated cloud environment. Tenant checks sit on every data path, not only at the front door.
Short-lived credentials
Agents and services use scoped, expiring, revocable credentials. Secrets never appear in prompts, traces or logs.
Least privilege, always
Role-based access for people and named scopes for agents. Nothing is public by default, and configuration is monitored for drift.
Never trained on your data
Customer data is used to serve you and nothing else. It is not sold, shared or used to train models.
Verified supply chain
Dependencies and models are pinned and verified. No remote code runs from a model registry. Releases are signed.
Standards and assurance
Examined, not asserted.
Controls are reviewed and tested on a regular basis, including by third parties. The current status lives in the Trust Center, where you can request the report.
Controls examined against the Trust Services Criteria: security, availability, confidentiality.
Data-subject rights supported, DPA available on request, California rights honoured.
Committed to the requirements that apply to our customers, and to emerging AI and privacy law.
Agent controls aligned with the OWASP LLM Top 10 and Agent Control Standard, and with NIST, CISA and NSA guidance on agent credentials and egress.
Continuous monitoring
The environment is watched for drift, anomalous access and unusual usage, with alerts to a staffed response.
Incident response
Any security incident affecting customer data is reported to the affected customer within 24 hours.
Responsible AI
Answers are grounded and cited, high-stakes outputs stay with a human, and where AI decides, its limits are disclosed.
Talk to us
See the posture live, or tell us what you found.
The Trust Center publishes our SOC 2 status, GDPR practices and the policies behind them. For a DPA, a sub-processor list or to report a vulnerability, write to us.