Security
Governance built into the architecture
Procurement-ready summary of how production agent systems handle data, access, and audit.
Data handling
I minimize stored client data. Workflow context is processed for the engagement scope only. Retention policies are defined per project and documented in the assessment.
Subprocessors
Typical stack includes Anthropic (model inference), Vercel (hosting), PostgreSQL provider (when applicable), and AWS (infrastructure). Full list available on request for procurement review.
Access controls
Environment isolation across preview, staging, and production. Secrets via platform environment variables — never embedded in client bundles or committed to source control.
Audit logging
Agent systems are designed with immutable action logs: tool calls, verdicts, approval gates, and human overrides. Logs support ops review and compliance inquiries.
Human-in-the-loop
No external state-changing action without an approval gate where the workflow requires it. Agents escalate with full context bundles rather than silent failures.
Model usage
Client data is not used to train models. Inference is scoped to the engagement. Model and subprocessor choices are documented for security review.
Next step
Request a security review pack
Available for procurement and engineering review — subprocessors, data flows, and access model.