Security Trust Center

Security Architecture

Six security domains covering the full attack surface — from transport to access control to supply chain.

🔐Authentication & Identity
All API access authenticated. Short-lived JWTs for UI sessions, scoped API keys for agent integrations. No shared secrets.
JWT HS256 with 24-hour expiry, refresh on activity
API keys: sk-aos- prefix, SHA-256 hashed at rest
Scoped keys: read-only, write, admin tiers
Brute-force protection on login endpoint (5 attempts → 15 min lockout)
No OAuth SSO yet — roadmap Q3 2026

🔒

Encryption

Data encrypted both at rest and in transit. TLS termination at nginx reverse proxy. Database files encrypted by filesystem.

TLS 1.3 enforced — TLS 1.0/1.1 disabled
HSTS header: max-age=31536000, includeSubDomains
AES-256 disk encryption on VPS filesystem
Passwords: bcrypt cost factor 12
API keys stored as SHA-256 hash — plaintext never persisted post-creation

🛡️

Infrastructure Hardening

Production VPS hardened to CIS benchmarks. No password SSH. Firewall default-deny. Non-standard admin ports.

SSH: key-pair only, root login disabled
UFW firewall: only 80/443/custom SSH port open
fail2ban: SSH brute-force detection active
Unattended-upgrades: kernel + security patches auto-applied
No unused services: minimal attack surface

🗄️

Data Isolation

Event data, user records, and API credentials stored in separate files with process-level isolation. No shared database with other services.

SQLite (agent-auth.db): users, sessions, API keys, interrupts
JSONL flat files: events, decisions, knowledge base — append-only by default
Per-org data isolation: agent namespacing via owner_id on all records
No cross-org data leakage: API enforces owner scope on every query
Admin endpoints: separate auth check (isAdmin flag) on all admin routes

📋

Audit & Observability

Every agent action, interrupt, override, and debrief is immutably logged. CONSCIENCE events are time-indexed and tamper-evident.

All governance events: written with ISO-8601 timestamp, agent_id, type, payload
OVERRIDE events: log selected option, resolver identity, resolution time
INTERRUPT events: full question + all options + resolver stored on close
API access logs: nginx access.log captures all requests with IP + user-agent
No log deletion endpoint — append-only by design

🔗

Supply Chain & Dependencies

Minimal dependency footprint. All packages pinned to exact versions. No client-side analytics or third-party scripts.

Backend: Node.js 20 LTS — active security support until April 2026
Core deps: express, better-sqlite3, bcryptjs, jsonwebtoken, cors — all pinned
Zero client-side third-party scripts (no GA, no Segment, no Intercom)
npm audit: 0 high/critical advisories at last check (2026-05-07)
Dependency updates: reviewed monthly, security patches applied within 48h

Encryption Specifications

Full technical specification for every encryption mechanism in the platform, by data class.

Data Class	Storage Location	Algorithm	Key Length	Status
User passwords	agent-auth.db	bcrypt (cost=12)	—	● Live
API keys	agent-auth.db	SHA-256 hash	256-bit	● Live
Session JWTs	Client localStorage	HMAC-SHA256 (HS256)	256-bit secret	● Live
Data in transit	nginx TLS termination	TLS 1.3	ECDHE-256	● Live
Disk filesystem	VPS block storage	AES-256-XTS	256-bit	● Live
Agent event data	events.jsonl (plaintext in encrypted FS)	AES-256 (filesystem)	256-bit	● Live
Database file	agent-auth.db (encrypted FS)	AES-256 (filesystem)	256-bit	● Live
Application-layer DB encryption	SQLite WAL	SQLCipher (AES-256-CBC)	256-bit	Roadmap Q3 2026
Webhook payloads in transit	Outbound HTTPS	TLS 1.2+ (recipient enforced)	—	● Live

Data Handling & Retention

What data Agent OS collects, how long it's kept, and how you can export or delete it.

Agent Event Data

CONSCIENCE, INTERRUPT, OVERRIDE, and DEBRIEF events written to append-only JSONL files. Includes agent_id, timestamp, event type, payload, and outcome. Retained indefinitely by default — configurable retention window on Enterprise plan. Export via GET /api/events/export (admin scope required).

User & Account Data

Email address, bcrypt-hashed password, role (admin/user/readonly), created_at timestamp. No PII beyond email. No phone, no address, no payment data stored on Agent OS servers. Account deletion removes user record, associated API keys, and interrupt assignments.

API Keys

SHA-256 hash stored — plaintext returned once at creation. Key metadata: label, scope (read/write/admin), created_at, last_used_at, expiry. Keys can be revoked instantly via UI or DELETE /api/auth/keys/:id. Revocation takes effect within 1 request (no caching).

Knowledge Base Entries

Auto-extracted from DEBRIEF events and manual entries. Contains lesson text, source_agent_id, confidence score, tags, created_at. Retained for platform lifetime — supports compliance audit queries back to day 1. Full export available via GET /api/knowledge-base/export.

Interrupt & Decision Records

Full question text, all options presented, selected option, resolver identity, and resolution timestamp. Immutable once resolved — no edit or delete endpoint. Supports evidentiary use in compliance audits. GDPR right-to-erasure requests handled via admin delete workflow (founder approval required).

Webhook Delivery Logs

Per-delivery: target URL (hashed for display), event type, HTTP status, latency_ms, response_body (first 500 chars), timestamp. Retained for 30 days rolling — no long-term storage of outbound response bodies. Endpoint registration stores URL in plaintext (required for delivery).

Waitlist & Trial Signups

Name, email, company, role, signup timestamp. Stored in waitlist.jsonl. Trial accounts auto-provisioned with 30-day API key. No marketing use without explicit consent. Deletion on request — contact [email protected]. GDPR subject access requests fulfilled within 30 days.

Access Logs

nginx access.log: IP address, timestamp, HTTP method, path, status code, user-agent. Retained for 90 days (log rotation). No request body logging. Failed authentication attempts logged with IP for fail2ban analysis. Logs accessible to platform admins only.

Role-Based Access Control

Four role tiers with explicit permission boundaries. All role checks enforced server-side on every request — no client-side role bypass possible.

Role: Admin

Platform Administrator

✓ View all agents, events, decisions
✓ Create/delete users and API keys
✓ Access waitlist activity dashboard
✓ Resolve any interrupt as override
✓ Export all data classes
✓ Configure webhooks and integrations

Role: User (Write)

Standard Platform User

✓ View agents, events, decisions (own org)
✓ Create API keys for own account
✓ Resolve interrupts assigned to them
✓ Submit knowledge base entries
✗ Cannot access admin routes
✗ Cannot create/delete other users

Role: Read-Only (API key scope)

Integration / Monitoring Key

✓ GET any data endpoint (events, agents, KB)
✓ Poll interrupt queue for monitoring
✗ Cannot POST events or mutations
✗ Cannot resolve interrupts
✗ Cannot access user management
✗ Cannot export data

Role: Guest (Token-Scoped)

Interrupt Share Link

✓ View single shared interrupt (by token)
✓ Resolve that one interrupt only
✗ Cannot view any other platform data
✗ No account or session created
✗ Token single-use — expires after resolution
✗ No repeat access after resolution

Compliance Readiness

Agent OS is purpose-built for enterprise AI governance — the same discipline applies to our own security controls. Current posture and certification roadmap below.

Framework / Control	Current Status	Evidence	Certification Target
SOC 2 Type I Security, Availability, Confidentiality trust criteria	In Progress	Controls documented; audit engagement scoped for Q3 2026	Q4 2026
SOC 2 Type II 12-month observation period required	Roadmap	Requires Type I completion first	Q2 2027
GDPR EU data subject rights, data minimisation, DPA readiness	Aligned	Minimal data collection, deletion workflow, no third-party sharing. DPA template available on request.	Ongoing
CCPA California Consumer Privacy Act	Aligned	No sale of personal data. Deletion on request. Data inventory complete.	Ongoing
ISO 27001 Information security management system	Roadmap	Gap analysis complete. 14 controls implemented. 12 controls in progress.	Q1 2027
OWASP Top 10 (2021) Web application security fundamentals	● Addressed	A01 Broken Access Control: RBAC enforced server-side. A02 Crypto Failures: AES-256 + TLS 1.3. A03 Injection: parameterised queries throughout. A05 Misconfig: headers audited. A07 Auth: bcrypt+JWT. Full audit documented.	Continuous
CIS Benchmarks (Ubuntu) Center for Internet Security server hardening	● Implemented	Level 1 controls applied: SSH hardening, UFW firewall, fail2ban, unattended-upgrades, minimal services. Level 2 audit scheduled Q3 2026.	Q3 2026 (Level 2)
HIPAA Health data handling (if applicable)	Not Applicable	Agent OS does not process Protected Health Information by default. BAA available for healthcare enterprise customers on request.	On request

Penetration Testing Schedule

Systematic security testing cadence. Every finding tracked from discovery to remediation.

✓

Internal Security Review — Platform Launch

● Complete May 2026

Full OWASP Top 10 self-audit on all 60+ API endpoints. Authentication bypass testing, injection testing on all input paths, header security audit (HSTS, CSP, X-Frame-Options), rate limiting validation, CORS policy audit. 0 critical, 0 high findings. 3 medium findings resolved before launch (rate limit on waitlist endpoint, CORS wildcard on admin routes narrowed, login lockout threshold set).

⟳

External Pen Test — Third-Party Engagement

Scheduled Q3 2026

Independent penetration test scoped across: web application (all public and authenticated endpoints), API security (all REST + WebSocket paths), authentication flows (JWT, API key, guest token), data isolation (cross-org access attempt), infrastructure (external-facing ports). Methodology: OWASP Testing Guide v4.2 + PTES. Findings report provided to enterprise customers under NDA.

○

Annual Pen Test Cadence

Planned Q1 2027 and annually thereafter

Annual third-party pen test tied to SOC 2 Type II observation window. Scope expands to include any new platform capabilities (multi-org, enterprise SSO, on-prem deployment). Remediation SLA: critical within 24h, high within 7 days, medium within 30 days. Findings disclosed to affected customers within 72h of confirmation.

○

Continuous Security Scanning

Implementing Q3 2026

Automated DAST scanning integrated into CI/CD pipeline. npm audit on every dependency update. Snyk or equivalent for dependency vulnerability monitoring with auto-PR for patch updates. GitHub security advisories monitored daily. Findings triaged by severity before any deployment.

Incident Response

Defined response times, escalation paths, and customer notification commitments for security incidents.

<1h

Critical Incident Response

Authentication bypass, data exposure, or service compromise. Immediate platform isolation if needed.

<4h

High Severity Response

Privilege escalation, cryptographic weakness, or major service degradation affecting data integrity.

<72h

Customer Notification

Affected customers notified within 72 hours of incident confirmation. Includes scope, impact, and remediation steps.

<7 days

Postmortem Publication

Public or customer-facing postmortem with root cause analysis, timeline, and permanent controls added.

Incident Classification

Incidents classified by impact scope and data exposure risk:

Severity	Definition	Response SLA	Notification
Critical	Data breach, auth bypass, arbitrary code execution	≤1 hour	Immediate + regulatory where required
High	Privilege escalation, data integrity issue, DDoS	≤4 hours	Within 24 hours
Medium	Rate limit bypass, minor data exposure, service degradation	≤24 hours	Within 72 hours
Low	Information disclosure, non-sensitive config exposure	≤7 days	Next monthly security update

Vulnerability Disclosure Policy

We welcome responsible disclosure. Researchers who find valid vulnerabilities are acknowledged and — for critical/high findings — eligible for recognition in our security hall of fame.

Responsible Disclosure Process

Discover — Identify a suspected vulnerability in any Agent OS endpoint, UI, or API.
Report — Email [email protected] with: affected URL/endpoint, reproduction steps, impact assessment, and any PoC you're comfortable sharing. Use PGP if the finding is sensitive (key available on request).
Acknowledge — We'll confirm receipt within 48 hours and assign a severity classification within 5 business days.
Remediate — We fix per the SLA above. You'll receive a confirmation when the fix is deployed. We ask for a 90-day disclosure embargo for critical/high to allow customer notification.
Disclose — After the embargo, you're welcome to publish your finding. We'll credit you in our public security acknowledgements unless you prefer anonymity.

In-scope: All vantageaiadvisory.com endpoints, Agent OS API (agent-auth-api), authenticated platform (agent-auth), public pages.
Out-of-scope: Third-party services (Cloudflare, DNS registrar), physical infrastructure, social engineering.
Safe harbour: Researchers acting in good faith under this policy will not face legal action from Vantage AI. We ask that you not access, modify, or exfiltrate real customer data beyond what's necessary to demonstrate the vulnerability.

Enterprise-Grade Security
Built In, Not Bolted On

Incident Classification

Responsible Disclosure Process

Security Contacts

Ready to Evaluate Agent OS?

Enterprise-Grade SecurityBuilt In, Not Bolted On

Incident Classification

Responsible Disclosure Process

Security Contacts

Ready to Evaluate Agent OS?

Enterprise-Grade Security
Built In, Not Bolted On