Security architecture.
The standard every engagement is built to: the threats we design against, the control at every layer, how each one maps to the frameworks auditors use, and exactly what we do and do not claim.
What we design against.
Agents read untrusted content and can take real actions. These six threats shape every system before a line of it is written.
Prompt injection
Instructions hidden in documents, emails or tool output that try to redirect an agent.
Data exfiltration
Sensitive fields leaving the boundary through model calls, logs or outbound actions.
Excessive agency
An agent holding more access or autonomy than its task requires.
Cross-tenant leakage
One client's records reachable from another client's session or run.
Approval forgery
A replayed, altered or self-issued approval executing an action no one approved.
Supply chain
A compromised dependency, leaked secret or unreviewed change reaching production.
Controls by layer.
Each layer assumes the one in front of it can fail. Each control names where it is enforced.
| Layer | Control | Enforced in |
|---|---|---|
| Identity | SSO through the client's identity provider over OIDC or SAML. MFA enforced at the IdP. Short-lived sessions. SCIM provisioning and deprovisioning. | IdP + session middleware |
| Tenancy | Row-level security on every tenant table. Tenant identity comes from the authenticated session, never from the request body. Cross-tenant access tests run in CI. | Postgres RLS + CI |
| Data | TLS 1.2+ in transit, AES-256 at rest with provider-managed keys. PHI kept to the minimum necessary and isolated by tenant. Field-level redaction before any model call where the data agreement requires it. | Platform + gateway |
| Model gateway | Every model call goes through one gateway: allowlisted models only, provider terms that exclude training on client data, zero-retention options where offered, per-tenant rate and spend limits. | Gateway policy |
| Agent runtime | Retrieved content and tool output are treated as data, never as instructions. Tools are scoped per job and validated against schemas. Content cannot invoke a tool on its own. | Runtime + schemas |
| Approvals | Consequential actions require an approval that is role-scoped, single-use, time-limited and bound to the SHA-256 of the exact payload. A changed payload voids the approval. | Gate service |
| Audit | Append-only audit log, with hash chaining where a client requires tamper evidence. Every input, tool call, model call, output and approval recorded per run, reviewable and exportable. | Audit store |
| Secrets | Secrets live in a managed vault with least-privilege keys and rotation. Secret scanning runs on every commit and blocks the merge on a finding. | Vault + CI |
| Supply chain | Lockfiles and pinned dependencies, dependency and secret scanning in CI, a protected main branch, reviewed merges and build-stamped releases. | CI/CD |
| Application | HSTS with includeSubDomains, a strict content security policy pinned to script hashes (no unsafe-inline, no framing), nosniff, a locked-down permissions policy, and validation at every boundary. | Edge headers |
| Resilience | Point-in-time restore with a 30-day window, daily snapshots, migrations rehearsed on a branch database, and restore drills run on a schedule. | Database + runbooks |
No action without a bound, signed approval.
Actions are classed by consequence. Anything that leaves the system needs an approval from a named person in the right role. The approval is signed, single-use and short-lived, and it is bound to the hash of the exact payload, so an edited message or a replayed approval cannot execute.
// approval token (illustrative)
const approval: ApprovalToken = {
run: "run_01JC8Q…",
action: "notices.send",
payload_sha256: "9f2c4e…b71a",
role: "compliance_lead",
approver: "usr_7Q2…",
nonce: "c41a…", // single use
exp: "2026-11-10T21:04:00Z", // short-lived
sig: "ed25519:9wFq3R0c…",
};HIPAA Security Rule.
Safeguards under 45 CFR Part 164, Subpart C, and the control that satisfies each one.
| Citation | Standard | Control |
|---|---|---|
| §164.312(a)(1) | Access control | Unique user identity through the IdP, role-scoped permissions, row-level security, automatic session expiry. |
| §164.312(b) | Audit controls | Append-only audit log of every agent and user action on ePHI, retained per the client's policy. |
| §164.312(c)(1) | Integrity | Schema validation at every boundary, payload-bound approvals, tamper-evident audit chain. |
| §164.312(d) | Person or entity authentication | SSO with MFA enforced by the client's identity provider; signed service credentials. |
| §164.312(e)(1) | Transmission security | TLS on every connection, HSTS at the edge, no plaintext transport. |
| §164.308(b) | Business associate contracts | BAAs signed with the client and with every subprocessor that touches PHI. |
OWASP Top 10 for LLM applications.
The risks that are specific to systems built on language models, and the control assigned to each.
| ID | Risk | Control |
|---|---|---|
| LLM01 | Prompt injection | Content-as-data runtime, scoped tools, approval gates |
| LLM02 | Sensitive information disclosure | Gateway redaction, RLS, minimum necessary |
| LLM05 | Improper output handling | Schema validation before any output is used |
| LLM06 | Excessive agency | Per-job tool scopes, payload-bound approvals |
| LLM10 | Unbounded consumption | Per-tenant rate and spend limits at the gateway |
What we claim, and what we don't.
Security reviews go faster when nothing is overstated. This is the exact position.
| Item | Status | Detail |
|---|---|---|
| HIPAA | BAA on request | There is no HIPAA certification. We sign a business associate agreement with any client whose data includes PHI, and hold BAAs with every subprocessor that touches it. |
| SOC 2 | Aligned, not audited | Controls are designed to the Trust Services Criteria. We do not hold a SOC 2 report today. Clients receive the control matrix and evidence under NDA. |
| ISO 27001 | Not certified | Not pursued at this time. |
| Penetration testing | Per engagement | Scoped to each client's deployment, with an independent tester when the client requires one. Findings are tracked to closure. |
| Subprocessors | Disclosed | Cloud hosting, database and model providers are listed in the client agreement, with their data terms. No subprocessor trains on client data. |
| Vulnerability disclosure | Open | Report issues to info@agencyai.software. Our security contact is published at /.well-known/security.txt. We acknowledge reports and do not pursue good-faith research. |
Aligned where auditors look.
We align controls to recognized frameworks and give each client the documentation its own audit needs.
SOC 2
Controls aligned to the Trust Services Criteria for security, availability and confidentiality: logical access (CC6), system operations (CC7) and change management (CC8).
NIST AI RMF
Govern, map, measure, manage: documented system cards, eval suites as measurement, approval gates and monitoring as management.
OWASP LLM Top 10
Prompt injection, sensitive information disclosure, improper output handling, excessive agency and unbounded consumption each have a named control above.
Documentation
System cards, data flow diagrams, the control matrix and subprocessor list are provided to clients under NDA.
The books are closed.
We work with a few enterprise companies at a time. If you have a project and want to know whether an opening comes up, write to us. You will get a straight answer either way.