Security

01Our posture

We are trusted with the documents that run companies and the source code that bills their customers. The controls below are how we earn that, and the architecture is designed so that the strongest option is always available to you: run everything yourself and give us nothing.

• Your data is never used to train models. Not your documents, not your source code, not your queries.
• Access control is enforced inside retrieval, not applied afterwards and never left to a prompt. What a user cannot read cannot be retrieved.
• Every deployment model is a first-class option — hosted, a runner inside your own VPC, on-premise, or fully air-gapped.
• Evidence over assertion. Per-query traces and file-and-line citations mean you can audit why the system said what it said.

02Deployment models

03Data protection

• In transit — TLS 1.2 or better for all external connections, with modern cipher suites and HSTS on our web properties.
• At rest — documents, indexes and backups are encrypted using AES-256 or the equivalent provided by the underlying storage platform.
• Secrets — credentials and provider keys are encrypted with authenticated symmetric encryption, stored separately from application data, and never returned unmasked through any interface or API.
• Tenant isolation — each organisation’s storage, indexes and vector namespaces are logically separated, and every query is scoped to the caller’s organisation before it runs.
• Backups — encrypted, access-controlled, and restore-tested on a schedule.
• Deletion — deletions propagate to indexes and backups within the retention window described in the DPA.

04Identity and access control

For your users

• Single sign-on via OIDC and SAML 2.0.
• SCIM provisioning and de-provisioning, so leavers lose access when your directory says so.
• Multi-factor authentication (TOTP) and step-up re-authentication for sensitive operations.
• Role-based permissions, per-document access control evaluated inside vector and keyword queries, and session revocation.

For our people

• Least privilege by default; production access is granted by role, reviewed regularly, and revoked on role change.
• Access to customer content requires a support request or an incident, is time-bound, and is logged.
• MFA is mandatory on every internal system. Administrative actions are recorded in an audit trail.

05AI-specific security

Machine-learning systems bring risks that traditional application security does not cover. We treat those as first-class.

• No training on customer data — contractually enforced with every model provider we route to.
• Prompt-injection defence — retrieved content is treated as untrusted data, not instructions. Tool use is scoped by capability, and actions with side effects sit behind a confirmation step.
• Capability scoping — API keys carry capabilities, so a read-only key stays read-only no matter what an agent is asked to do.
• Grounding and abstention — anti-hallucination modes, a faithfulness self-check, and honest abstention when the corpus does not contain the answer.
• Sandboxed execution — generated tests and code run in an isolated sandbox with no access to production systems or customer networks.
• Content moderation and abuse monitoring on inputs and outputs.
• Traceability — a per-query trace records retrieval scores, fusion, reranking and the final prompt.

06Application and infrastructure security

• Secure development — peer review on every change, automated tests in CI, and no direct pushes to production branches.
• Dependency management — automated vulnerability scanning on dependencies and container images, with prioritised remediation.
• Static and secret scanning in the pipeline to catch issues and stray credentials before they merge.
• Infrastructure as code — environments are reproducible and changes are reviewed like application code.
• Network — minimal exposed surface, segmented internal networks, and no direct database exposure to the internet.
• Monitoring — centralised logging, alerting on anomalies, and audit export to your SIEM.

07Incident response

We maintain a documented incident response plan with defined roles, severity levels and communication paths, and we exercise it.

• Detect and triage — alerts are assessed on receipt and assigned a severity.
• Contain and eradicate — the immediate priority is stopping harm, preserving evidence, and closing the path in.
• Notify — where a personal data breach affects your data, we notify you without undue delay and within 72 hours of becoming aware, with the detail you need for your own regulatory obligations.
• Learn — every significant incident gets a written post-incident review with corrective actions tracked to completion.

08People

• Background checks on personnel with production access, where local law permits.
• Confidentiality obligations in every employment and contractor agreement.
• Security and privacy training at onboarding and annually, including AI-specific risks.
• Documented joiner, mover and leaver processes, with access revoked on the last working day.

09Compliance and frameworks

Our controls are designed and mapped against recognised frameworks, and the platforms include the features customers need to meet their own obligations — retention policies, right-to-be-forgotten workflows, PII detection and redaction, audit export, and data-residency controls.

• SOC 2 Trust Services Criteria and ISO/IEC 27001 — used as the design basis for our security control set.
• GDPR and UK GDPR — addressed through our Data Processing Addendum, including Standard Contractual Clauses.
• NIST AI RMF, ISO/IEC 42001 and the EU AI Act — used to structure AI governance for ourselves and for the customers we advise.
• HIPAA — supported through self-hosted and VPC deployments; contact us before processing PHI so we can agree the right arrangement.

10Reporting a vulnerability

If you believe you have found a security issue, we want to hear from you before anyone else does.

Email [email protected] with enough detail to reproduce — affected endpoint or component, steps, impact, and any proof of concept. We acknowledge within two business days and keep you updated until it is closed.

Safe harbour

We will not pursue legal action against researchers who act in good faith, give us reasonable time to remediate before disclosing, avoid privacy violations and service degradation, and do not access, modify or exfiltrate data belonging to anyone else.

Out of scope

• Denial-of-service or volumetric testing, and physical or social-engineering attacks against our staff.
• Reports from automated scanners with no demonstrated impact, and missing best-practice headers with no exploit path.
• Vulnerabilities in a customer’s own self-hosted deployment — report those to that customer, though we welcome a copy for the open-source project.

Issues in the open-source ERAG codebase can also be reported through the project repository’s private advisory process.