Documentation · Trust & operations

Trust,
and how we run.

Where your data lives and how it is protected, where models are used and what they see, the security and observability backbone, how change is managed, and what is built today versus in development.

Data handling

Connect once, govern everything, and nothing leaves the tenant. Everything ingested is processed and stored within the tenant boundary and is never used for model training. The one governed exception is model inference on the SaaS Cloud deployment, under zero-retention, no-training terms; private cloud and on-premises keep inference inside the boundary too.

Governance entities

In the governance lakehouse

Controls, frameworks, risks, assets, obligations, authorities, vendors, findings, normalized into canonical definitions.

Evidence artifacts

In the governance lakehouse

Documents, configurations, test results, remediation records, linked to specific controls and frameworks.

Decision traces

In the governance lakehouse

Input, reasoning, authority, output, and modification traces for every AI decision, queryable by auditors.

Decision & Evidence Ledger

In the governance lakehouse

Append-only, covering every human and AI action with attribution, timestamp, and context. Cannot be modified or deleted.

Source credentials

In the secret store

Read-only service accounts, encrypted. Write-capable credentials are rejected at connection setup.

Source system records

Read in place

Assurance reads source systems continuously; it does not take ownership of or write back to operational records.

Model training data

Never

Customer data is never used for training, fine-tuning, or model improvement, in any deployment model.

All data is encrypted at rest with AES-256 and in transit with TLS 1.3, with customer-managed key options in private cloud. Tenant isolation is complete, with no shared storage, compute, or memory.

AI exposure

One place that consolidates where models are used, what they see and decide, and the human role around each. Note that authority evaluation is deterministic: where the platform judges an action against a delegation, no model is in the decision path.

Specialized assurance agents

LLM, governed runtime

Autonomy: Propose only; findings gated by severity

Human role: HITL validation of critical and high findings; approval before any remediation executes.

LLM-as-Judge validator

Separate LLM instance

Autonomy: Evaluates only; never generates findings

Human role: Rubrics calibrated against expert assessments.

Multi-agent consensus

Multiple independent agents

Autonomy: Convergence required to proceed

Human role: Disagreements route to qualified reviewers.

Otto governance assistant

LLM, governed runtime

Autonomy: Read-only, citation-backed answers

Human role: User verifies against cited sources.

Reasoning-based retrieval

Tree traversal plus embeddings

Autonomy: Retrieval only

Human role: None required; answers carry citations and confidence.

Authority evaluation

Deterministic rules, no model

Autonomy: No generation; evaluates and derives

Human role: Named approver on the delegation decides exceptions.

ContextOS memory and graph

Episodic, semantic, procedural stores

Autonomy: Grounding infrastructure; no generation

Human role: Drift detection flags deviation from baselines.

Predictive intelligence

In-platform intelligence

Autonomy: Signals and forecasts only

Human role: Reviewed as input, never as a finding.

Security, governance & observability

The security, governance, and observability capabilities are inherited from the Core Platform rather than bolted on at the application layer, so every control proven in production is available from day one.

Data encryption

AES-256 at rest and TLS 1.3 in transit, with customer-managed key options for private cloud deployments.

Tenant isolation

Complete data separation between tenants with no shared storage, compute, or memory. Cross-tenant data access is architecturally impossible.

SOC 2

A SOC 2 programme is in place with policies effective January 2026; the Type II examination is in progress. Current attestation status and the auditor's report are available from your account team under NDA.

Third-party vulnerability scanning

Regular scanning across all platform surfaces, including API endpoints, agent interfaces, and administrative consoles.

No customer data training

Customer data is never used for model training, fine-tuning, or improvement. Processing occurs within the tenant boundary exclusively for the customer's benefit.

Identity

Access through the institution's identity provider; personas bind to directory groups. Service access uses scoped, expiring tokens.

Governance

Immutable audit trail

Every action, human or AI, is logged in the append-only Decision & Evidence Ledger with full attribution, timestamp, and context. It cannot be modified or deleted.

Policy enforcement

Organizational policies are encoded as machine-enforceable rules that constrain agent behavior, data access, and workflow progression automatically.

Impact analysis

Before schema changes, pipeline modifications, or logic updates propagate, impact analysis identifies all affected downstream consumers. Changes are versioned and impact-tested first.

End-to-end lineage

Full lineage runs from source system through ingestion, transformation, and agent processing to final output. Every finding traces to its data origins and its delegation.

Schema change detection

Automatic detection of upstream schema changes, with clear visibility into which dashboards, models, and agents are affected, preventing silent breakage.

Observability

Agent monitoring

Real-time monitoring of agent behavior including response latency, context utilization, memory access patterns, and output quality.

Decision tracing

A full trace of the reasoning path for every finding, from initial query through context assembly, retrieval, reasoning, authority and judge evaluation, and human decision.

Performance dashboards

Operational dashboards tracking agent latency, validation throughput, scoring consistency, and system resource utilization.

Anomaly detection

Automatic flagging of unexpected agent behavior, such as unusual data access patterns, scoring shifts, or output format deviations, before they affect compliance outcomes.

More on how we run our own estate is on the Security page.

Operations & change management

Nothing that alters how findings are produced ships silently. Prompt templates, scoring rubrics, evaluation methodology, compiled rules, tool interface versions, and agent configurations are versioned artifacts under change control, because in a regulated setting a change to methodology is a change to the control environment.

  1. 01Change proposed

    A model version, prompt template, rubric, compiled rule, or agent configuration change enters the release pipeline as a versioned artifact.

  2. 02Regression run

    The evaluation framework runs the change against benchmark suites of expert-validated control-evidence pairs, detecting degradation before production.

  3. 03A/B evaluation

    New configurations are evaluated against production baselines under controlled conditions, so improvements are validated rather than assumed.

  4. 04Impact analysis

    Downstream dashboards, agents, and validation workflows affected by the change are identified and impact-tested.

  5. 05Release & rollback

    The change ships with a changelog calling out anything affecting agent behavior, model routing, or defaults, and a documented rollback to the last pinned version.

Hard boundaries

The commitments that hold across every deployment.

Read-only to source systems

Connector credentials are read-only and verified at connection setup; write-capable credentials are rejected. There is no write path to fail open.

No AI action without attributed authorization

Least-privilege agent access, no persistent agent credentials, every request evaluated against user, resource, action, and environment attributes.

No action without traceable authority

Where an action has no valid delegation path, it is recorded as shadow authority and surfaced, not silently permitted.

No unreviewed findings

No AI-generated finding, score, or recommendation reaches a human without passing structured evaluation; none escalates or reaches a report at critical or high severity without human validation.

No autonomous actions of record

AI cannot approve, escalate, override, or modify risk ratings. That boundary is architectural.

No training on customer data

Ever, in any deployment model.

Ingested data never leaves the tenant

Ingestion, processing, and storage occur within the tenant boundary; model inference also stays inside it everywhere except SaaS Cloud, where prompts travel under zero-retention, no-training terms.

Everything is logged

An immutable, append-only ledger spans every reasoning step and every human decision, exportable to SIEM.

Roadmap

Everything documented across the platform is in production in Assurance today, with the exception of the items below. They carry no capability, timeline, or availability commitment, and are listed for architectural orientation only.

Data governance agents

In development

Asset discovery, data quality, classification, and semantic glossary, the first components of Provenance.

Provenance

In development

A registry of the AI-consuming estate, full-spectrum lineage, and discovery with shadow-authority detection, as a standalone plane across the estate rather than within Assurance alone.

Runtime

In development

A policy decision point with enforcement adapters (advisory API, gateway interception, native platform hooks, asynchronous detection), human-in-the-loop orchestration, spend and fleet ceilings, and containment.

Authority & Policy Compiler simulation

In development

Simulation of compiled policy against historical decisions before activation, with versioned release and rollback. Compilation and evaluation run today; simulation tooling does not.