Security practices
How every Startup keeps its data safe from the first record, with encryption, write-only secrets, isolated customers, task-bound access and a full record.
Every Startup runs the same security practices from its first record, and none of them can be turned off. Each practice is a Control the platform tests every day, over every record.
What every Startup gets
| Practice | What it means | Details |
|---|---|---|
| Encryption | Every call travels over TLS, and every record, file and backup is encrypted under its namespace's own keys | Encryption |
| Secrets | Keys and account tokens are write-only: no person, agent or model reads one back | Secrets |
| Isolation | Each customer's data sits in its own Tenant, and a namespace reads only its own records unless an Agreement grants a scoped read | Namespace isolation |
| Reading data | An agent's token holds its Role's Permissions over its Task's Nouns, and expires with the Task | Task-bound access |
| Record | Every act is an Event in a log no writer can edit | Audit log |
| Recovery | Every past state stays readable, and restore drills prove it | Restore drills |
Encryption
Encryption is a locked Setting at the platform root, so no Startup inherits a way around it. Each namespace's data keys are wrapped under the platform root key and re-wrapped once a year.
Old keys stay as versions, so history and backups still read. Every rotation is an Event an auditor can read like any other record.
Who can reach what
Every Action runs under a signed-in identity, a person or an agent, and records who it was. What that identity may do comes from the Role it holds, through an Access Level made of Permissions.
Access only narrows on its own. A Permission widens through an approved Change, never by direct edit, and unused Permissions narrow each night. A Worker who leaves a Role loses its Permissions the moment it leaves.
Money has one more rule. The seat that creates a payee or a Bill never approves its payment.
Test and live
Every key and every call runs in test or live. Actions in test never touch live records, move real money or send a message to a real person, so an agent can rehearse anything first. Environment separation tests that boundary.
Watching and testing
| Practice | Rule |
|---|---|
| Boundary protection | Every inbound request passes authentication and rate limits; every outbound call leaves through one gateway |
| Vulnerability management | Every dependency and running Version is scanned daily, and each known flaw is fixed within its severity deadline |
| Adversarial testing | A tester attacks every preventive Control daily in test, and each attempt is recorded as a refused Action |
| Anomaly monitoring | Each alert opens an Issue or an Incident within five minutes |
| Incident handling | Each Incident is contained, restored and closed with a postmortem and the Change that prevents a repeat |
Compliance
Every Startup is covered by a SOC 2 report from its first day. ISO 27001, HIPAA and GDPR map onto the same Controls, as the framework map shows. Card data never touches the platform, so PCI DSS is carved out to Stripe.
The opinion in the report belongs to an outside firm. A Startup is covered by a report, never certified, and a buyer's security review reads the same records: answering a security review.
Next
- API key handling: the keys your code, agents and customers hold.
- Data residency: where each record is stored and processed.
- Your data: who owns it, export and erasure.