# Security practices

URL: /systems/trust-and-governance/security · Id: `page:systems/trust-and-governance/security`

> How every Startup keeps its data safe from the first record, with encryption, write-only secrets, isolated customers, task-bound access and a full record.

Every [Startup](/business/nouns/startup) runs the same security practices from its first record, and none of them can be turned off. Each practice is a [Control](/business/nouns/control) the platform tests every day, over every record.

## What every Startup gets
| Practice | What it means | Details |
| --- | --- | --- |
| Encryption | Every call travels over TLS, and every record, file and backup is encrypted under its namespace's own keys | [Encryption](/code/platform/encryption) |
| [Secrets](/business/nouns/secret) | Keys and account tokens are write-only: no person, agent or model reads one back | [Secrets](/code/platform/secrets) |
| Isolation | Each customer's data sits in its own [Tenant](/business/nouns/tenant), and a namespace reads only its own records unless an [Agreement](/business/nouns/agreement) grants a scoped read | [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation) |
| Reading data | An agent's token holds its [Role](/business/nouns/role)'s [Permissions](/business/nouns/permission) over its [Task](/business/nouns/task)'s [Nouns](/business/nouns/noun), and expires with the Task | [Task-bound access](/systems/trust-and-governance/controls/task-bound-access) |
| Record | Every act is an [Event](/business/nouns/event) in a log no writer can edit | [Audit log](/systems/trust-and-governance/audit-log) |
| Recovery | Every past state stays readable, and restore drills prove it | [Restore drills](/systems/trust-and-governance/risk-and-continuity) |

## Encryption
Encryption is a locked [Setting](/business/nouns/setting) at the platform root, so no Startup inherits a way around it. Each namespace's data keys are wrapped under the platform root key and re-wrapped once a year.

Old keys stay as versions, so history and backups still read. Every rotation is an Event an auditor can read like any other record.

## Who can reach what
Every [Action](/business/nouns/action) runs under a signed-in identity, a person or an agent, and records who it was. What that identity may do comes from the [Role](/business/nouns/role) it holds, through an [Access Level](/business/nouns/access-level) made of [Permissions](/business/nouns/permission).

Access only narrows on its own. A Permission widens through an approved [Change](/business/nouns/change), never by direct edit, and unused Permissions narrow each night. A [Worker](/business/nouns/worker) who leaves a Role loses its Permissions the moment it leaves.

Money has one more rule. The seat that creates a payee or a [Bill](/business/nouns/bill) never approves its payment.

## Test and live
Every key and every call runs in test or live. Actions in test never touch live records, move real money or send a message to a real person, so an agent can rehearse anything first. [Environment separation](/systems/trust-and-governance/controls/environment-separation) tests that boundary.

## Watching and testing
| Practice | Rule |
| --- | --- |
| [Boundary protection](/systems/trust-and-governance/controls/boundary-protection) | Every inbound request passes authentication and rate limits; every outbound call leaves through one gateway |
| [Vulnerability management](/systems/trust-and-governance/controls/vulnerability-management) | Every dependency and running [Version](/business/nouns/version) is scanned daily, and each known flaw is fixed within its severity deadline |
| [Adversarial testing](/systems/trust-and-governance/controls/adversarial-testing) | A tester attacks every preventive Control daily in test, and each attempt is recorded as a refused Action |
| [Anomaly monitoring](/systems/trust-and-governance/controls/anomaly-monitoring) | Each alert opens an [Issue](/business/nouns/issue) or an [Incident](/business/nouns/incident) within five minutes |
| [Incident handling](/systems/trust-and-governance/controls/incident-handling) | Each Incident is contained, restored and closed with a postmortem and the Change that prevents a repeat |

## Compliance
Every Startup is covered by a SOC 2 report from its first day. ISO 27001, HIPAA and GDPR map onto the same Controls, as the [framework map](/systems/trust-and-governance/frameworks) shows. [Card](/business/nouns/card) data never touches the platform, so PCI DSS is carved out to Stripe.

The opinion in the report belongs to an outside firm. A Startup is covered by a report, never certified, and a buyer's security review reads the same records: [answering a security review](/systems/trust-and-governance/buyers).

## Next
- [API key handling](/systems/trust-and-governance/api-keys): the keys your code, agents and customers hold.
- [Data residency](/systems/trust-and-governance/data-residency): where each record is stored and processed.
- [Your data](/systems/trust-and-governance/your-data): who owns it, export and erasure.