What we hold, what we don't, and what we do instead.

Certifications

What is in place instead

• Tenant isolation, tested on every route

  Two tenants are seeded side by side. Every API route is called as the other tenant, before and after the first one has data. A difference in IDs, status codes or bodies fails the build.

  Backed by backend/tests/test_tenant_isolation.py

• Every route has a declared access class

  Each route is classed as tenant, operator, gateway key, internal secret, connector secret or public. A route added without a class fails the authorization matrix test.

  Backed by backend/tests/test_authz_matrix.py

• Credentials encrypted at rest

  Provider keys, connector credentials and each tenant's evidence-signing key are encrypted with a per-install key that never leaves your vault on a self-hosted install.

  Backed by backend/tests/test_encryption_at_rest.py

• Tamper-evident audit log

  Audit entries are hash-chained. Changing one row breaks the chain at that row, and the break shows up in verification.

  Backed by backend/tests/test_audit_chain.py

• Evidence an auditor verifies without us

  Evidence bundles are signed (Ed25519) with your tenant's key and verified offline with a standalone verifier. Tampering with the database after the fact shows up in the bundle.

  Backed by backend/tests/test_evidence_bundle.py

• Every new control starts in dry_run

  A new enforcement logs what it would have blocked until you switch it to enforce. Denied tools are the one exception, and they're enforced from the start.

  Backed by backend/tests/test_egress.py

• Failures are written down

  What happens when a dependency fails, at every decision point, with a fault-injection test per row. An allow caused by a failure is always recorded.

  Backed by docs/FAILURE_MODES.md

• Secrets fail closed

  Internal secrets are compared in constant time, an unset secret matches nothing, and production refuses to boot with a missing or development-default secret.

  Backed by backend/tests/test_internal_secrets.py

Your data

• Cloud: the steps your agents send are stored in our Postgres for the raw-step retention period (90 days). With content capture off for an agent, only a hash and the redacted tool arguments are kept.
• On-premise and air-gapped: everything stays in your own database, and we have no access to it.

What we cannot see

AgentWatch sees what agents report or route through Gate. It has no endpoint collector, no provider admin APIs and no package-registry feed. The checks that need those say “not collected”. The full list is on Status, the sources are in Data sources, and what that means against real attacks is on Incidents.

Report a security issue

Email agentwatchsupport@gmail.com.