Security

Agents never hold your keys. Every action is checked, recorded and kept only as long as you need it.

Request access
By design

Safe by default.

The platform, not the agent, holds the keys and decides what runs.

No credentials in the workspace

Agents act through the gateway. Secrets stay encrypted with KMS.

workspace encrypted

Code runs in a sandbox

Chat sandboxes run under gVisor, apart from the host.

host $ npm test ✓ 48 passed gVisor sandbox

Message text stays out of logs

Logs keep ids, not words. Analytics drop personal fields.

run=4812 turn=3 status=ended chars=412 hash=9f3a text email dropped dropped
Access

Access and approvals.

People decide what agents may do, and the platform checks it on every call.

Org owner, admin Sets policy, connections and budgets Project admin Approves every change to the project Member Asks for work and approves actions

  • Roles

    Org owners and admins set policy. Project admins approve changes. Members approve actions.

  • Scoped connections

    Each project reaches only the connections it is given.

  • Linked identities

    A click in Slack counts only from a person with a linked account and the right role.

  • Personal accounts

    When an agent acts as a person, it uses that person’s own connected account.

  • Approvals

    Sensitive actions and every change to a project wait for a person to approve.

Encryption

Encryption and isolation.

Secrets are encrypted at rest, and each run stays inside its own workspace.

slack token secret data key, AES-GCM KMS wraps the data key

  • Envelope encryption

    Connection secrets, login tokens and webhook secrets are encrypted with KMS-managed keys.

  • Private storage

    Transcripts and attachments live in a private bucket, encrypted with KMS.

  • Signed webhooks

    Inbound events are checked against a per-hook or per-connection secret.

  • Workspace guards

    File tools cannot reach outside the run’s workspace, even through a symlink.

  • Plugins without secrets

    Plugins carry no credentials. Org hooks run only if an org admin turns them on.

Audit

A record of everything.

You can see what every agent did, why it was allowed and who approved it.

trace 7f3a91c2 09:14:02 09:14:02 09:14:03 09:15:40 09:16:05 Event in from Slack Trigger p1-unanswered matched Run 4812 started jira.comment allowed Reply posted in the thread

  • Every action

    Each tool call is stored with the rule that allowed it and its result.

  • Every decision

    Approvals record who decided, when and on what.

  • Every change

    Records and project memory keep a history of each change and who made it.

  • Every plugin

    Each plugin version records its author, its diff and who approved it.

  • One trace

    A trace id links each reply to the event that caused it.

Retention

Data kept only as long as needed.

Each kind of data has one retention period. Orgs can lengthen some of them.

Traces 14 Events, logs 30 Conversation text 180 Actions, history 365 Transcripts 365 Analytics 400 0100200300400 days
DataKept for
Events30 days
Conversation text180 days, then the text is removed
Actions and rule steps365 days
Record and memory history365 days
Transcripts and attachments365 days
Analytics, without personal fields400 days
Logs and traces, ids only30 days and 14 days

Erase a person

An org admin can erase a member or an outside user. Their messages, links and personal connections are removed or redacted in every store, and each step is recorded.

Offboard an org

The org owner can close the org. Hinzel pauses its work, closes its runs, cancels billing and deletes its data, in that order.

Questions about security? Ask us.

Hinzel is in early access. Tell us about your team and we will set up your first project with you.