Documentation · Trust & operations
Trust,
and how we run.
Where your data lives and how it is protected, where models are used and what they see, the security and observability backbone, how change is managed, and what is built today versus in development.
Data handling
Connect once, govern everything, and nothing leaves the tenant. Everything ingested is processed and stored within the tenant boundary and is never used for model training. The one governed exception is model inference on the SaaS Cloud deployment, under zero-retention, no-training terms; private cloud and on-premises keep inference inside the boundary too.
Governance entities
In the governance lakehouse
Controls, frameworks, risks, assets, obligations, authorities, vendors, findings, normalized into canonical definitions.
Evidence artifacts
In the governance lakehouse
Documents, configurations, test results, remediation records, linked to specific controls and frameworks.
Decision traces
In the governance lakehouse
Input, reasoning, authority, output, and modification traces for every AI decision, queryable by auditors.
Decision & Evidence Ledger
In the governance lakehouse
Append-only, covering every human and AI action with attribution, timestamp, and context. Cannot be modified or deleted.
Source credentials
In the secret store
Read-only service accounts, encrypted. Write-capable credentials are rejected at connection setup.
Source system records
Read in place
Assurance reads source systems continuously; it does not take ownership of or write back to operational records.
Model training data
Never
Customer data is never used for training, fine-tuning, or model improvement, in any deployment model.
All data is encrypted at rest with AES-256 and in transit with TLS 1.3, with customer-managed key options in private cloud. Tenant isolation is complete, with no shared storage, compute, or memory.
AI exposure
One place that consolidates where models are used, what they see and decide, and the human role around each. Note that authority evaluation is deterministic: where the platform judges an action against a delegation, no model is in the decision path.
Specialized assurance agents
LLM, governed runtimeAutonomy: Propose only; findings gated by severity
Human role: HITL validation of critical and high findings; approval before any remediation executes.
LLM-as-Judge validator
Separate LLM instanceAutonomy: Evaluates only; never generates findings
Human role: Rubrics calibrated against expert assessments.
Multi-agent consensus
Multiple independent agentsAutonomy: Convergence required to proceed
Human role: Disagreements route to qualified reviewers.
Otto governance assistant
LLM, governed runtimeAutonomy: Read-only, citation-backed answers
Human role: User verifies against cited sources.
Reasoning-based retrieval
Tree traversal plus embeddingsAutonomy: Retrieval only
Human role: None required; answers carry citations and confidence.
Authority evaluation
Deterministic rules, no modelAutonomy: No generation; evaluates and derives
Human role: Named approver on the delegation decides exceptions.
ContextOS memory and graph
Episodic, semantic, procedural storesAutonomy: Grounding infrastructure; no generation
Human role: Drift detection flags deviation from baselines.
Predictive intelligence
In-platform intelligenceAutonomy: Signals and forecasts only
Human role: Reviewed as input, never as a finding.
Security, governance & observability
The security, governance, and observability capabilities are inherited from the Core Platform rather than bolted on at the application layer, so every control proven in production is available from day one.
Data encryption
AES-256 at rest and TLS 1.3 in transit, with customer-managed key options for private cloud deployments.
Tenant isolation
Complete data separation between tenants with no shared storage, compute, or memory. Cross-tenant data access is architecturally impossible.
SOC 2
A SOC 2 programme is in place with policies effective January 2026; the Type II examination is in progress. Current attestation status and the auditor's report are available from your account team under NDA.
Third-party vulnerability scanning
Regular scanning across all platform surfaces, including API endpoints, agent interfaces, and administrative consoles.
No customer data training
Customer data is never used for model training, fine-tuning, or improvement. Processing occurs within the tenant boundary exclusively for the customer's benefit.
Identity
Access through the institution's identity provider; personas bind to directory groups. Service access uses scoped, expiring tokens.
Governance
Immutable audit trail
Every action, human or AI, is logged in the append-only Decision & Evidence Ledger with full attribution, timestamp, and context. It cannot be modified or deleted.
Policy enforcement
Organizational policies are encoded as machine-enforceable rules that constrain agent behavior, data access, and workflow progression automatically.
Impact analysis
Before schema changes, pipeline modifications, or logic updates propagate, impact analysis identifies all affected downstream consumers. Changes are versioned and impact-tested first.
End-to-end lineage
Full lineage runs from source system through ingestion, transformation, and agent processing to final output. Every finding traces to its data origins and its delegation.
Schema change detection
Automatic detection of upstream schema changes, with clear visibility into which dashboards, models, and agents are affected, preventing silent breakage.
Observability
Agent monitoring
Real-time monitoring of agent behavior including response latency, context utilization, memory access patterns, and output quality.
Decision tracing
A full trace of the reasoning path for every finding, from initial query through context assembly, retrieval, reasoning, authority and judge evaluation, and human decision.
Performance dashboards
Operational dashboards tracking agent latency, validation throughput, scoring consistency, and system resource utilization.
Anomaly detection
Automatic flagging of unexpected agent behavior, such as unusual data access patterns, scoring shifts, or output format deviations, before they affect compliance outcomes.
More on how we run our own estate is on the Security page.
Operations & change management
Nothing that alters how findings are produced ships silently. Prompt templates, scoring rubrics, evaluation methodology, compiled rules, tool interface versions, and agent configurations are versioned artifacts under change control, because in a regulated setting a change to methodology is a change to the control environment.
- 01Change proposed
A model version, prompt template, rubric, compiled rule, or agent configuration change enters the release pipeline as a versioned artifact.
- 02Regression run
The evaluation framework runs the change against benchmark suites of expert-validated control-evidence pairs, detecting degradation before production.
- 03A/B evaluation
New configurations are evaluated against production baselines under controlled conditions, so improvements are validated rather than assumed.
- 04Impact analysis
Downstream dashboards, agents, and validation workflows affected by the change are identified and impact-tested.
- 05Release & rollback
The change ships with a changelog calling out anything affecting agent behavior, model routing, or defaults, and a documented rollback to the last pinned version.
Hard boundaries
The commitments that hold across every deployment.
Read-only to source systems
Connector credentials are read-only and verified at connection setup; write-capable credentials are rejected. There is no write path to fail open.
No AI action without attributed authorization
Least-privilege agent access, no persistent agent credentials, every request evaluated against user, resource, action, and environment attributes.
No action without traceable authority
Where an action has no valid delegation path, it is recorded as shadow authority and surfaced, not silently permitted.
No unreviewed findings
No AI-generated finding, score, or recommendation reaches a human without passing structured evaluation; none escalates or reaches a report at critical or high severity without human validation.
No autonomous actions of record
AI cannot approve, escalate, override, or modify risk ratings. That boundary is architectural.
No training on customer data
Ever, in any deployment model.
Ingested data never leaves the tenant
Ingestion, processing, and storage occur within the tenant boundary; model inference also stays inside it everywhere except SaaS Cloud, where prompts travel under zero-retention, no-training terms.
Everything is logged
An immutable, append-only ledger spans every reasoning step and every human decision, exportable to SIEM.
Roadmap
Everything documented across the platform is in production in Assurance today, with the exception of the items below. They carry no capability, timeline, or availability commitment, and are listed for architectural orientation only.
Data governance agents
In developmentAsset discovery, data quality, classification, and semantic glossary, the first components of Provenance.
Provenance
In developmentA registry of the AI-consuming estate, full-spectrum lineage, and discovery with shadow-authority detection, as a standalone plane across the estate rather than within Assurance alone.
Runtime
In developmentA policy decision point with enforcement adapters (advisory API, gateway interception, native platform hooks, asynchronous detection), human-in-the-loop orchestration, spend and fleet ceilings, and containment.
Authority & Policy Compiler simulation
In developmentSimulation of compiled policy against historical decisions before activation, with versioned release and rollback. Compilation and evaluation run today; simulation tooling does not.
More in the documentation