Security & governance

Controls built into the platform, not bolted on around it

Deployments.ai is designed so agents can run inside other products without becoming the weakest part of them. These are the controls the platform implements today.

  1. 01Tenancy & identity

    Every request is checked against live membership

    Authorization is the intersection of live membership, scopes, and the resource — not stale token claims. Humans sign in at a platform-owned OAuth and OIDC issuer; services use environment-scoped API keys.

    • Organization, project, and environment isolation
    • Roles: owner, admin, billing, member, viewer
    • PKCE, rotating refresh tokens, KMS-signed tokens
    • API keys stored only as SHA-256 hashes

  2. 02Secrets & credentials

    Secrets never enter model context

    Credentials live in a vault with KMS envelope encryption and are injected only at execution. Values never appear in manifests, OpenTofu configuration, tool calls, messages, artifacts, or the thread stream.

    • AES-256-GCM with a per-write data key
    • Encryption context bound to org, project, environment, and purpose
    • Short-lived, tenant-scoped credentials for vault access
    • OAuth with PKCE, refresh, and revocation for connections

  3. 03Model & tool isolation

    Contain what models and tools can reach

    Model calls go through a private gateway that holds the provider keys; workers only ever see short-lived signed tokens. Code runs in MicroVM sandboxes, and risky tool writes wait for approval.

    • Provider keys never leave the model gateway
    • Hosted code runs with no network access by default
    • Tenant-supplied URLs blocked from private and reserved IPs
    • Approval required by default for client, browser, and vendor-MCP writes

  4. 04Data protection

    Encrypted at rest and in transit, minimal by default

    Artifacts and governance data use SSE-KMS with a customer-managed, rotating key. Observability defaults to metadata only — prompt and tool bodies stay out of the analytics store unless you opt in.

    • TLS 1.2+ on public endpoints
    • DynamoDB point-in-time recovery
    • Trace capture: metadata-only, redacted, or full content
    • HMAC-SHA256 signed webhooks with secret rotation

  5. 05Governance

    Retention, export, erasure, and signed audit trails

    Organizations set retention, export everything they own, erase it on request, and hand auditors exports they can verify independently.

    • Configurable retention, with audit logs kept longer by default
    • Tenant export as deterministic NDJSON
    • Owner-only erasure that also purges search and analytics stores
    • Audit exports hash-chained, ECDSA-signed, and Object Locked

  6. 06Infrastructure

    An AWS account boundary per environment

    OpenTofu provisions the platform into a dedicated AWS account for each environment, so development and production are isolated at the account level — and you can run the whole stack in accounts you own.

    • Dedicated AWS account per environment
    • Private networking for internal services
    • Request throttling on public APIs
    • Container images pinned by digest

Deployments.ai is pre-release and its source is public. We describe the controls the platform implements; we don't claim compliance certifications. Questions about security: support@deployments.ai.