Security & compliance
ExoHuman is built for companies that put AI agents to work on real systems. This page summarises the security model. For specifics, follow the links to each area.
Isolation by design
Section titled “Isolation by design”- A dedicated instance per customer. Every ExoHuman Cloud customer gets their own instance — database, secrets, storage and agent containers. Instances are never multi-tenant. See Instances & architecture.
- A container per agent. Each agent runs in its own container with its own filesystem, processes, resource limits and credentials. Containers start with a restricted capability set by default; full capabilities (for example to install system packages) must be enabled per agent.
- Agent-to-agent calls are denied by default. An agent can only reach another along permissions a person grants, and every refusal is audited.
- Agents placed on your worker nodes run inside your network, on machines you control — see Worker nodes.
Identity and access
Section titled “Identity and access”- People can only sign in once an administrator admits them. Sign-in uses one-time email codes, or single sign-on with OpenID Connect, optionally as the only method.
- Two-factor authentication (TOTP) can be required for administrators and creators.
- SCIM provisioning lets your identity provider create and suspend accounts.
- Four instance roles (
user,operator,creator,admin) and teams with delegated responsibilities. See Users, roles & teams. - Every agent has exactly one owner; sharing grants use, never configuration or credential access.
- All authorization is enforced on the server. Hidden UI is a convenience, never the control.
Credentials and secrets
Section titled “Credentials and secrets”- Credentials, OAuth tokens, signing secrets and integration secrets are encrypted at rest (AES-256-GCM).
- Credentials are injected only into the agent that needs them. People an agent is shared with cannot open its credential files.
- The credential vault grants organisation secrets to specific agents, fetched at runtime with output scrubbing so values don’t leak into logs or chat.
- API keys are scoped, attributable and revocable. Secrets such as webhook signing keys are shown once.
- Model provider keys can be your own (no markup) — see Platform keys.
Human control
Section titled “Human control”- Autonomy is off for new agents: nothing runs on a schedule until someone turns it on.
- Approvals — agents ask a person before sensitive actions, and gated skills require approval by a role. See Inbox & approvals.
- Guardrails, read-only mode, circuit breakers, timeouts and budgets bound what an agent can do and spend.
- Emergency stop and schedule pause act on the whole fleet at once.
Audit and monitoring
Section titled “Audit and monitoring”- An append-only audit log records sign-ins, permission decisions, configuration and credential changes, every MCP tool call and git operation.
- Optional hash chain makes tampering evident; entries are kept at least 365 days.
- Stream security events to your SIEM (HTTPS webhook, Splunk HEC or syslog).
- Every execution keeps its full transcript in logs.
- Region. Your instance and its data live in the region you choose; see what stays there and what can leave.
- Private by default. The platform sends no telemetry, bug reports or usage data to us unless an administrator opts in.
- Model traffic goes only to the providers you connect. Choose providers and data-processing terms that fit your policy.
- Backups are encrypted and kept in your instance’s region. See Backups & recovery.
- Export and deletion — export your agents and data at any time; see Cancelling & data export.
- Agent memory lives in git, so you have a full, inspectable history of what agents remember.
Network
Section titled “Network”- All traffic to your instance uses HTTPS.
- Agents are not reachable directly from the internet; inbound access is through the platform only.
- Integrations verify inbound requests (Slack signing secret, Twilio signatures, Telegram webhook secret, HMAC-signed webhooks).
- Outbound MCP connections to private network addresses are blocked unless explicitly allowed.
Compliance
Section titled “Compliance”Enterprise customers can request our security documentation, data processing agreement and answers to security questionnaires through sales. The Enterprise plan includes compliance audit exports, SSO and SCIM provisioning; agents on your own worker nodes keep their working data inside your infrastructure.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Email security issues to the support address on the Support page with “Security” in the subject. Please give us reasonable time to fix before disclosure.