Security
Security that's architecture,
not a policy document.
Credentials the model never sees. Agents on isolated machines with scoped keys they can't exceed. Models you can audit down to the weights — because they're open. And when that's not enough, take the whole stack inside your walls.
Independently verified.
Real statuses, including the in-progress ones. Ask for the reports.
What your agent does. What it never does.
Does
- Encrypts everythingTLS in transit, AES-256 at rest, secrets in dedicated vaults.
- Authenticates with your SSOSAML 2.0 — Okta, Entra ID, Google Workspace, any compliant IdP.
- Operates under scoped keysEvery agent runs on a key with explicit grants, TTLs, and budget caps.
- Revokes instantlyKill a task, pause an agent, or disconnect an integration in one click. Full audit log.
Never does
- Train on your dataNot our models, not anyone's. Your prompts, files, and memory stay yours.
- See your credentialsKeys and tokens are injected at execution time by the gateway — never in model context.
- Act above its grantSensitive actions wait for approval in your chat; an agent can't exceed its key's scope even if asked.
- Cross tenant linesEach agent runs on its own isolated machine — memory, files, and skills never touch another customer.
AI-specific risks, handled in the architecture.
Agents create attack surfaces normal SaaS doesn't have. Four controls keep them small.
Invisible credentials
The gateway injects secrets at execution time. A prompt-injected agent can't leak keys it never saw.
Approval gates
Money, code pushes, external emails — gated behind explicit approve/reject in your chat. Injection can't move what approval guards.
Machine-level isolation
Each agent's browser, files, and memory live on its own machine — a compromised task can't reach another agent, or another customer.
Scoped by construction
Child keys with tags, TTLs, and budgets mean even agent-spawned agents inherit hard limits, not good intentions.
The audit no closed lab can offer.
Our models are open-weight. Your security team can inspect the exact artifacts that process your data — not a model card, the weights. And if your requirements outgrow any shared cloud, the entire platform deploys inside your walls, up to fully air-gapped.
Trust, then verify, then — if you want — take the keys. Explore Self-Hosted →
Security FAQ.
- Does the model see our API keys or passwords?
- No. Credentials are stored in encrypted vaults and injected at execution time by the gateway — never present in model context, planning, or logs.
- What about prompt injection?
- Untrusted content is treated as data, not instructions; high-risk tools sit behind approval gates and scoped keys. An injected agent can't exceed its grant.
- Which channels can it read?
- Only channels it's explicitly invited to, DMs sent to it, and files shared with it. Remove it from a channel and access ends immediately.
- How do we delete everything?
- Offboarding removes the agent's machine, memory, embeddings, and files. Deletion semantics are documented in the DPA.
- Found a vulnerability?
- Tell us: security@hypercli.com. We'd rather hear it from a researcher than read about it on X. Recognition, public credit if you want it, and platform credits while our formal bounty program stands up.
Security review coming?
Send your questionnaire — or skip a cycle and read the architecture first.