Security & Trust

Encrypted in transit and at rest. All traffic uses TLS 1.2 or higher. Data is encrypted at rest with AWS KMS, and credentials get a second layer of application-level encryption (AES-128-CBC + HMAC) with keys held in AWS Secrets Manager: never in code. Agent authentication secrets are stored as one-way SHA-256 hashes, not encrypted. Encryption keys support staged rotation with no downtime.

You set the window; the schema enforces it. Every workspace has an explicit governance-evidence retention period: indefinite retention isn't an option. The default is 730 days, which is also the ceiling: a workspace can shorten its window, never extend it. Database-level constraints mean a misconfiguration can't silently destroy your trail. Workspaces that self-declare as high-risk AI deployers get a 183-day floor, matching EU AI Act Article 26(6). Searchable audit history is a separate plan entitlement: 7 days on Free, 90 days on paid plans, and longer for Enterprise as agreed, within the evidence retention window. Expiration of searchable history does not itself delete stored evidence, and a longer history entitlement cannot restore deleted records. The Terms specify a 90-day storage minimum unless an Order Form or DPA provides otherwise; shorter configured windows must be consistent with that agreement and applicable minimums. Retention is two-tier: keep governance evidence for years while scrubbing tool-call content on a shorter clock. Every purge is attested by a retained, hash-chained record, and a purge aborts entirely if audit-chain verification fails, so cleanup can never destroy evidence of tampering.

Every record is scoped to your workspace at the row level, and every query and export is filtered to the calling workspace. Administrative endpoints are role-gated. Guardyx AI records the tool calls your agents make, including call arguments and results (that's the evidence the product exists to produce) and you control how long that content is kept independently of the surrounding audit metadata.

Your audit trail is tamper-evident. Every governance event is linked into a per-workspace SHA-256 hash chain, so any after-the-fact modification is detectable at the exact record. Verification runs on demand and its result is embedded in every evidence pack you export. When an agent connects over OAuth on a person's behalf, every event records who it was acting for; a call made with a static API key names no one rather than guessing. Every action in the compliance export and evidence PDF also states whether a human reviewed it, who decided, through which channel, and when.

Sign in with your own identity provider over OIDC, with role-based access control (RBAC) across the portal and administrative actions. Removing a member ends what they held and what they issued: their MCP OAuth grants, the agents they registered for themselves, their personal connections, the pending invitations they sent, the incident share links they created, and the auto-approve grants they issued. Agents they own but did not register stay in place to be reassigned, with every existing key invalidated. An MCP client connected over OAuth must ask its user to consent again 90 days after the original consent. Connectors that sign in only over OAuth, such as the Claude.ai connector, Meta Muse and Grok Bot, are never issued a static API key, and one presented for them is refused.

Route approvals to the Guardyx AI portal, Slack, or email, wherever your team already works. By default, an agent connected over MCP must state why before a call that needs approval can be held; a call without a reason goes back to the agent to retry with one. Approvers see that reason in the portal, in email and in Slack direct messages, always labelled as the agent's own and unverified; Slack channel posts never show it. After a decision, the Slack card keeps the tool, agent, risk and a link back to the request, and direct-message copies also keep the reason and argument preview. In Slack and email, links and look-alike addresses inside agent-written text are disarmed so they cannot be clicked. In Slack, hidden or invisible characters in the arguments are shown as visible markers, so the preview cannot read differently from what will run. If Slack approval messages start failing to deliver, Settings says so and what to do about it.