How we secure the software.
Self-hosting removes us from your data path, which is the control that matters most here. Your data sits on infrastructure you run. This page covers what the software enforces, how we handle credentials and inference, and the decisions behind both.
Every send
Nothing leaves without a person.
An agent may read and draft. Anything that goes out, a reply or a payment, stops at a gate until a person approves it, and the record keeps who did.
- Draft only
- Agents get the least access that does the job. They write drafts. They do not send.
- Checked at the edge
- What an agent returns is validated. A wrong shape fails loudly and is never retried quietly.
- A person approves
- The gate waits for a yes. A draft never sends itself.
- On the record
- Every run and every approval is logged, so you can answer who changed what.
Done: approved by a person, sent, and logged
Done- The agent drafts
- The result is checked
- A person approves
- Sent once
- Logged
Controls built into the code.
- The audit table accepts inserts only. It refuses UPDATE and DELETE, and a test enforces that.
- An integration test blocks any cross-tenant read across every entity type, and CI fails if that ever regresses.
- The codebase refers to credentials by environment-variable name and never holds their values. Secrets live in your environment.
- Agent actions that reach the outside world stop for human approval by default.
- On the SF-default tier (coming soon) the inference proxy is being built to retain no prompt content. We will confirm that in writing before the tier opens. Your persistent data does not pass through Solutions Factory on any tier.
- You can deploy on your own EU cloud, your own GPU and your own database, and the sovereign tier keeps inference local as well.
Where your data is, and where it is not.
Persistent data sits in your database, on infrastructure you control. That covers contacts, deals, itineraries, money records, agent telemetry and audit logs. No shared multi-tenant cloud holds it. Your data stays where you put it, and none of it passes through us. Inference is the exception, and it is the one you control: on the default tier, once it opens, your prompts will route through our metered proxy; bring your own key and they go straight to the model provider; or run the sovereign tier and nothing leaves your building at all.
On the SF-default tier, which is coming soon, prompt content will pass through a proxy we are designing for zero data retention. We have not shipped or verified that yet, and we will confirm it in writing before the tier opens. On the Sovereign tier, nothing leaves at all: the model runs on your own GPU.
DPA and SCC paperwork is available for the managed tier, and will be for the SF-default tier when it opens. The Sovereign tier sidesteps most of it by keeping inference in-house.
The decisions behind it.
The posture above is recorded as architecture decision records in the product repositories.
| Record | What it decides |
|---|---|
| ADR 0013 | Three-tier compliance posture (sovereign cloud, EU residency, self-hosted LLM). |
| ADR 0017 | Operator-zone secrets. Credentials are referenced by name and their values stay in the environment. |
| ADR 0021 | Operator-confirm gates on outbound agent actions. |
| ADR 0023 | Read-only dashboard. The control plane observes and never acts unsupervised. |
| ADR 0042 | Single-operator credential vault. |
| ADR 0001 | Substrate baseline, covering the append-only audit log and the tenant-scoped data plane. |
| ADR 0006 (this site) | Three-tier inference model, including the zero-data-retention proxy posture planned for Tier 1 (coming soon). |
Send the security questionnaire.
We answer security questionnaires, and we would rather you read the decision records than take our word for it. Start a conversation and we will route it to a named human.