TRUST & SECURITY
Built to be governed, not trusted blindly
Last updated October 2026 · applies to AI Factory
AI Factory writes code for your repositories, so it is built so that no agent can do more than its one job, and no person loses the final say. This page states plainly what it does today and what we do not yet do. Detailed security architecture documentation is available under NDA.
Runs on hardware you hold
The orchestrator and its tools run on your infrastructure. Only a stateless request for text leaves for the model provider.
No network where code runs
Your repo's code runs only in hardened containers with no network and no token.
Never merges
It never merges, deploys or pushes to main. Your team owns every merge.
DATA FLOW
Where your code and data go
Nothing moves that you cannot name.
Your codeStays in your GitHub repository and on hardware you control. GitHub is the only source of truth for code.
Model callsAWS Bedrock only. One structured request in, one validated object out; the provider holds no session, memory or credential.
PackagesOnly through a private package proxy. Install scripts are never run.
CredentialsShort-lived, minted by the control plane only. Anything near repo code is read-only and scoped to one repository.
Run recordsKept with you, not sent anywhere. Your repository carries the evidence your team reviews.
ZERO TRUST
Two identities, never one
The part that thinks and the part that runs code are separate identities, and neither is ever widened to work around a problem: a gap gets a new, narrow grant.
Control planeCalls the model and mints short-lived credentials. Runs on hardware you hold.
Execution planeHas no access to cloud data at all. It never mints a credential; it only receives one short-lived value.
Tool accessEvery external effect goes through a named tool on a named server. Each step gets one narrow adapter that refuses anything outside its allow-list before any request is made.
THE SANDBOX
No network where code runs
Every check that runs your repo's code uses two hardened containers. Nothing from your repo or its dependencies ever runs where there is a network or a token.
InstallClones the exact commit and installs dependencies with install scripts switched off, through a private package proxy only.
RunRuns the one command with no network at all, and refuses to start if a network interface is up.
HardeningRead-only file system, every capability dropped, no privilege escalation, a non-root user and a time limit per check.
TokensEvery token near repo code can read one repository and nothing else. Tokens never land in the git configuration, and are removed before any repo code could run.
GOVERNANCE
Limits enforced by code
The factory's limits are not instructions a model might ignore. They are checks in code, each tested by switching it off and confirming a test fails.
No policy, no writesA repository without a reviewed policy file gets no writes at all.
Three layersThree independent layers check every write. A protected path ends the run and is never retried.
Capped callsEvery agent has a call limit per run. Going past it needs a person's approval.
Decisions, not guessesAnything only you can decide becomes a decision issue, and the run pauses until your approver answers.
OUR COMMITMENTS
Data protection
The commitments Getamazednow AI makes on every engagement.
No trainingNo training on customer data. Ever.
RetentionAgreed retention windows per engagement, with deletion on request and full export at any time — no data hostage.
AgreementA data-processing agreement is available for execution before any data is shared.
EncryptionEncryption in transit and at rest for any managed deployment.
INCIDENTS AND CERTIFICATION
Stated honestly
Incident responseA documented incident-response plan applies to every engagement: a named contact, defined notification windows, and post-incident reporting to your security function. It is reviewed with your team at onboarding.
Certification roadmapWe are an early-stage company and do not claim certifications we do not hold. SOC 2 Type I is planned with platform GA (FY28); SOC 2 Type II and ISO/IEC 42001 alignment follow in FY29. Until then, partners receive our security architecture documentation.
Security reviewWe expect and welcome security and architecture review by your teams before any engagement begins. If your estate — or ours — is not ready, we will say so.