Skip to content
Contact salesRequest access

Security

Governance is the security model.

Every agent action is identified, decided and recorded.

Report a vulnerabilityRead the DPA

Controls in place today.

  • 01

    Hexel Studio Identity

    Passkeys, multi-factor sign-in and short-lived tokens.

  • 02

    Agent identity

    Agents prove who they are; tokens last minutes.

  • 03

    Approvals

    Sensitive actions wait for the right person.

  • 04

    Signed, short-lived grants

    One call, 30 seconds, bound to its exact arguments.

  • 05

    Credential vault

    Secrets are added at execution, never given to the agent.

  • 06

    Egress control

    HTTPS only, to the exact host, with no redirects.

  • 07

    Isolation by identity

    Every record is scoped to your organization.

  • 08

    Kill switch

    By organization, workspace, environment, agent, deployment, session, capability, connection or destination.

  • 09

    Verifiable audit

    Signed events and a tamper-evident ledger.

Questions reviewers ask.

Straight answers, including what isn’t built yet.

Where does our data live?
In Titan Cloud, in a tenant of your own. Every record carries your organization, workspace and environment, and every query is scoped by your token.
Do agents ever hold our credentials?
No. Credentials stay in an encrypted vault and are added at execution, one call at a time. The agent gets the result, never the key.
What gets recorded, and can it be changed?
Every decision, approval, execution and stop goes into the Agent Ledger, each entry sealed to the one before. Audit events are signed, archived write-once and kept for two years by default, and any one of them can be verified.
What does a stop actually stop?
Everything after it. A stopped session, agent, connection or organization is refused from the very next call. A stop can’t recall data that already left, or undo a change another system already made.
What happens if Titan can’t be reached?
Governed actions stop. Without a decision there is no grant, and without a grant no credential is added, so the action is refused rather than waved through.
Can it run inside our own environment?
Not yet. Titan Dedicated is next. Your own Kubernetes cluster, on-premises and classified networks come later.
Are you SOC 2 certified?
Not yet. Hexel Studio is pre-launch, and we won’t claim SOC 2 or any other certification until we have the report.

Bring us your security review.

We’ll walk your team through every control.

Talk to usRequest access