A bad document can't give your agent orders.
Agents read text they don't control and call real systems. Here is how Vicero keeps that contained, and what we haven't done yet.
In place today
- Every query scoped to your organisation
- Provider keys encrypted at rest
- Prompt injection neutralised in retrieved text
- SSRF guard on every outbound fetch
- Signed webhooks and n8n calls
- An audit log your admins can read
Not done yet
- An independent penetration test
- Compliance certifications such as SOC 2 or ISO 27001
The path a message takes.
Three of these steps are checks written in code, not instructions in a prompt.
Tenants are isolated
Every query is scoped to the organisation. Isolation is enforced where data is fetched, not left to the interface.
Guardrails are code
Blocked topics are refused before the model is called, retrieved text is treated as data, and secrets are redacted from replies. A line in a prompt is a request; these are checks.
Outbound fetches are guarded
HTTP tools, URL ingestion and custom model endpoints go through an SSRF guard that also covers redirects.
Keys are encrypted
Provider API keys are encrypted at rest and never logged. Passwords use argon2, and sessions use short-lived tokens with an httpOnly refresh cookie.
Changes are logged
Your admins can see who changed what, and when.
Integrations are signed
Webhooks and n8n calls are HMAC-signed in both directions, and an unsigned workflow can't be attached as a tool.
Found something? Email hello@vicero.ai.