Skip to content

Security and compliance readiness

Your agents. Your authority.

Keep memory scoped, decisions reviewable, and people in control. Bring documented controls to your next security review.

Request a security review

Prepare for your next review.

Bring your compliance requirements. Start with the controls and evidence behind your agent memory.

Control evidence

SOC 2

Review access boundaries, deletion behaviour, and available audit records against your control requirements.

No SOC 2 report claimed

Review controls

Security management review

ISO 27001

Use documented technical controls and contractual commitments in your information security assessment.

No ISO 27001 certification claimed

Discuss your requirements

Privacy and data handling

GDPR

Inspect scoped access, deletion, processing terms, and subprocessors for your data protection review.

Compliance depends on your use

Read the DPA

Deployment assessment

FedRAMP

Discuss jurisdictional configuration and the wider service boundary before planning federal workloads.

No FedRAMP status claimed

Review placement limits

Controls and documentation are not certification. No independent attestation or FedRAMP Ready designation is implied. Any certified scope must be confirmed in writing.

Controls for governed agents.

Access stays scoped

Isolated Nuclei and validated Scopes define the memory boundary. Persisted permissions and explicit deny rules filter the context an agent can receive.

People approve high-risk actions

Consequence workflows keep scenarios, decisions, and approvals structured and reviewable. High-risk execution requires recorded human approval.

Forgotten memory stays forgotten

Tombstones and scope-version checks keep deleted memory out of recall, context caches, queues, and archive workflows.

Placement with clear boundaries

Choose global, regional, or supported jurisdictional profiles. Regional preferences are best-effort; regulated deployments require configuration and contractual review.

Your memory remains yours

Customer memory is not used to train models without separate, explicit written opt-in consent. Your application keeps control of model-provider credentials and downstream calls.

Evidence you can inspect

Documented controls, available audit exports, and retention options support security review. Enterprise controls depend on your plan, configuration, and contract.

Test the boundary you need.

Use invented records to verify positive recall, requested Scope filtering, tombstones and fresh context after deletion. Review the separate evidence for queue, archive, cache and compaction paths before relying on a production configuration.

Review the details

Built-in controls and Enterprise options

Built in

  • Tenant and scope validation
  • Context-time agent permissions and explicit deny rules
  • Temporal versions, confidence, provenance, and contradiction records
  • Deletion-aware recall and context caching
  • Bounded structured consequence artifacts
  • Human approval and reviewed-learning gates
  • Rate limits and stable API error contracts
  • Safe operational logging without sensitive payloads

Enterprise options

  • Audit exports and configurable retention
  • SSO/SAML and dedicated review paths
  • Regional or jurisdictional deployment planning
  • Compliance contracts, SLAs, and support
  • Customer-specific security review
Storage choices

Global

Default placement for globally distributed products and general agent workloads.

Optimised for broad availability and low-friction integration.

Regional

Best-effort placement preferences for broad regions such as North America, Europe, or Asia-Pacific.

A latency and operational preference, not a standalone legal residency commitment.

Jurisdictional

Supported profiles for regulated Enterprise deployments with stricter review paths.

EU and FedRAMP-oriented review is subject to contract and configuration.

Regional preferences are not legal residency guarantees. Regulated use requires configuration and contractual review.

Frequently asked questions

Bring your requirements.

Review controls, deployment scope, and contractual commitments with the Neutron AI team.

Request a security review