Skip to content
Docs

Security & Compliance

AgentWatch’s purpose is compliance for the customer’s AI usage — not merely the vendor’s own certification. The distinction is deliberate: a platform can hold a SOC 2 report and still give an organization no compliance posture for the AI applications running on it.

Which compliance frameworks are supported?

Section titled “Which compliance frameworks are supported?”

A framework selector is a first-class admin control. Choose the frameworks the organization operates under — GDPR, HIPAA, SOX, PCI-DSS, SOC 2, ISO 27001, NIST, HITRUST — and AgentWatch activates the matching detection categories, data-handling rules, retention policies, and audit-report templates as a bundle, rather than requiring each control to be configured individually.

How is data retention governed?

Section titled “How is data retention governed?”

Retention is configurable per data type, with defaults of one year for audit records, 90 days for conversations, 180 days for metrics, and 90 days for events. Longer retention is configurable where a regulator requires it. Audit reports export as JSON, CSV, or PDF from the console, or programmatically for SIEM ingestion and long-term archival.

What authentication and identity controls are available?

Section titled “What authentication and identity controls are available?”
  • Native SAML 2.0 as a service provider, with signed assertions, metadata exchange, and single logout — no external IdP gateway required.
  • OAuth2 / OIDC with discovery, multiple providers per organization, domain restriction, and configurable group claims. Authorization Code with PKCE, refresh token, and legacy flows are supported.
  • LDAP / Active Directory over LDAP and LDAPS, with CA certificate upload and configurable attribute mapping — including routing users from one directory into different organizations by email domain.
  • SCIM v2 provisioning per organization, with named tokens shown once, usage telemetry, expiry, and revocation.
  • Group-to-team mapping unified across all three protocols, applied at first login and refreshed on subsequent logins.
  • Account security — failed-login lockout, forced password change, administrator-transfer tracking, key expiry, and rotation alerts.

A local super-administrator fallback keeps the platform recoverable if directory binding fails.

How granular is access control?

Section titled “How granular is access control?”

Roles run from platform super administrator through organization administrator to ordinary user, plus named custom roles per organization assembled from individual permission keys. Scoping dimensions include user, team, organization, model, MCP server, individual tool, gateway route, guardrail policy, plugin, and schema. Audit access is split so that reading records is a separate permission from exporting them — an analyst can investigate without being able to exfiltrate.

How is data protected in transit and at rest?

Section titled “How is data protected in transit and at rest?”

Prompts and responses are scanned inline before leaving the organization for PII, PHI, financial data, and secrets, with block, redact, or log-only actions per policy — see Data protection and guardrails. Credentials and sensitive fields are encrypted in the database. Transport uses TLS 1.2/1.3 across HTTP/1.1, HTTP/2, and HTTP/3, and endpoint agents authenticate to the gateway with mutual TLS. Containers run as a non-root user from a multi-stage build, and the Helm chart ships with a pre-hardened security context.

Is each organization really isolated?

Section titled “Is each organization really isolated?”

Yes. Providers, keys, model catalogs, employees, teams, budgets, DLP policies, audit trails, and analytics are all tenant-scoped at the data layer, with no cross-organization access path. Every governance dimension is scoped the same way, which is what makes AgentWatch suitable for use as a multi-tenant governed AI gateway rather than only as an internal tool.

What about data sovereignty and air-gapped operation?

Section titled “What about data sovereignty and air-gapped operation?”

Each deployment is region-local: audit records, usage data, and embeddings remain inside the deployment region, and only the model calls leave — to providers the customer has explicitly authorized. Replacing those with self-hosted inference such as Lifeboat closes the boundary entirely. A fully air-gapped mode runs with zero outbound dependency, pulling images, weights, and library mirrors once from an internal registry, with local log shipping and no vendor cloud in the path.

Is AgentWatch itself certified?

Section titled “Is AgentWatch itself certified?”

AgentWatch is deployable software, so attestations such as SOC 2 Type II, ISO 27001, or FedRAMP apply to a deployed instance plus the operating organization’s controls, not to the software in the abstract. A customer’s deployment inherits the certifications of the underlying cloud or data center and whatever controls the customer’s own security team layers on. What AgentWatch contributes to an audit is the technical evidence: enforced role separation, inline data-loss prevention, immutable and exportable audit trails, framework-aligned retention, and demonstrable control over which models and providers may be used.

What is out of scope?

Section titled “What is out of scope?”

AgentWatch governs the AI traffic layer. Infrastructure concerns belong elsewhere: GPU management and model-weight protection sit with the inference platform; confidential computing is a property of the infrastructure it is deployed on; service-mesh mutual TLS and network micro-segmentation belong to the Kubernetes or SDN layer, which AgentWatch consumes rather than orchestrates. External secret-manager integration (HashiCorp Vault, cloud key vaults) is not native — credentials are encrypted in the platform’s own store. Uptime SLAs are a property of the customer’s deployment contract, though the architecture supports high availability and multi-region operation.

Sources and references

Section titled “Sources and references”