Security & Compliance

AgentWatch’s purpose is compliance for the customer’s AI usage — not merely the vendor’s own certification. The distinction is deliberate: a platform can hold a SOC 2 report and still give an organization no compliance posture for the AI applications running on it.

Which compliance frameworks are supported?

A framework selector is a first-class admin control. Choose the frameworks the organization operates under — GDPR, HIPAA, SOX, PCI-DSS, SOC 2, ISO 27001, NIST, HITRUST — and AgentWatch activates the matching detection categories, data-handling rules, retention policies, and audit-report templates as a bundle, rather than requiring each control to be configured individually.

How is data retention governed?

Retention is configurable per data type under Settings → Compliance → Data Retention Policies: audit records (default 365 days), conversations (90), and metrics (180). Longer retention is configurable where a regulator requires it.

Deletion is opt-in, and off until you switch it on. Setting a number records the policy; it does not by itself remove anything. Tick “Actually delete data older than these limits” in the same panel to schedule a daily sweep that permanently deletes audit entries and usage records past those limits, for that organization only.

The switch is off on every deployment, including upgrades, and that is deliberate: before 2.0.298 the day counts were recorded but never acted on, so the values already stored were chosen when nothing enforced them. Enforcing them automatically at upgrade would delete history against numbers nobody had reviewed, and deletion cannot be undone. Check the three numbers before enabling.

Behaviour	Rule
A limit of 0	Means do not delete. It is never read as “delete everything”
A limit under 7 days	Refused — 7 days is the floor
Scope	Only the organization that enabled it; one tenant’s sweep can never touch another’s data
Accounting	Each sweep writes one retention.swept audit entry per organization recording exactly what was removed
Volume	Deletions are batched and capped per run, so a first sweep over a long history runs as a background chore rather than one enormous transaction

To see the blast radius before committing, an operator can run the deployment with AW_RETENTION_DRY_RUN=1, which reports what would be removed and deletes nothing. AW_RETENTION_SWEEP=0 disables the sweep entirely.

Audit reports export as JSON or CSV from the console, or programmatically for SIEM ingestion and long-term archival. An export larger than 100,000 rows is truncated, and says so — the JSON carries complete: false with truncated, rowCap and truncatedSections, and the CSV carries a banner at the top and again at the end of each truncated section. If you see it, narrow the range with ?days= (or filter by provider, source or tag) and export again to collect the remainder; the file you are holding is a page of the record, not the record.

What authentication and identity controls are available?

• Native SAML 2.0 as a service provider, with signed assertions, metadata exchange, and single logout — no external IdP gateway required.
• OAuth2 / OIDC with discovery, multiple providers per organization, domain restriction, and configurable group claims. Authorization Code with PKCE, refresh token, and legacy flows are supported.
• LDAP / Active Directory over LDAP and LDAPS, with CA certificate upload and configurable attribute mapping — including routing users from one directory into different organizations by email domain.
• SCIM v2 provisioning per organization, with named tokens shown once, usage telemetry, expiry, and revocation.
• Group-to-team mapping unified across all three protocols, applied at first login and refreshed on subsequent logins.
• Account security — failed-login lockout, forced password change, administrator-transfer tracking, key expiry, and rotation alerts.

A local super-administrator fallback keeps the platform recoverable if directory binding fails.

How granular is access control?

Roles run from platform super administrator through organization administrator to ordinary user, plus named custom roles per organization assembled from individual permission keys. Scoping dimensions include user, team, organization, model, MCP server, individual tool, gateway route, guardrail policy, plugin, and schema. Audit access is split so that reading records is a separate permission from exporting them — an analyst can investigate without being able to exfiltrate.

How is data protected in transit and at rest?

Prompts and responses are scanned inline before leaving the organization for PII, PHI, financial data, and secrets, with block, redact, or log-only actions per policy — see Data protection and guardrails. Credentials and sensitive fields are encrypted in the database. Transport uses TLS 1.2/1.3 across HTTP/1.1, HTTP/2, and HTTP/3, and endpoint agents authenticate to the gateway with mutual TLS. Containers run as a non-root user from a multi-stage build, and the Helm chart ships with a pre-hardened security context.

Is each organization really isolated?

Yes. Providers, keys, model catalogs, employees, teams, budgets, DLP policies, audit trails, and analytics are all tenant-scoped at the data layer, with no cross-organization access path. Every governance dimension is scoped the same way, which is what makes AgentWatch suitable for use as a multi-tenant governed AI gateway rather than only as an internal tool.

What about data sovereignty and air-gapped operation?

Each deployment is region-local: audit records, usage data, and embeddings remain inside the deployment region, and only the model calls leave — to providers the customer has explicitly authorized. Replacing those with self-hosted inference such as Lifeboat closes the boundary entirely. A fully air-gapped mode runs with zero outbound dependency, pulling images, weights, and library mirrors once from an internal registry, with local log shipping and no vendor cloud in the path.

Is AgentWatch itself certified?

AgentWatch is deployable software, so attestations such as SOC 2 Type II, ISO 27001, or FedRAMP apply to a deployed instance plus the operating organization’s controls, not to the software in the abstract. A customer’s deployment inherits the certifications of the underlying cloud or data center and whatever controls the customer’s own security team layers on. What AgentWatch contributes to an audit is the technical evidence: enforced role separation, inline data-loss prevention, immutable and exportable audit trails, framework-aligned retention, and demonstrable control over which models and providers may be used.

What is out of scope?

AgentWatch governs the AI traffic layer. Infrastructure concerns belong elsewhere: GPU management and model-weight protection sit with the inference platform; confidential computing is a property of the infrastructure it is deployed on; service-mesh mutual TLS and network micro-segmentation belong to the Kubernetes or SDN layer, which AgentWatch consumes rather than orchestrates. External secret-manager integration (HashiCorp Vault, cloud key vaults) is not native — credentials are encrypted in the platform’s own store. Uptime SLAs are a property of the customer’s deployment contract, though the architecture supports high availability and multi-region operation.

What is recorded, and for how long?

Every gateway call produces a usage row — actor, model, tokens, cost, latency, policy outcome — and the full transcript is retrievable on drill-down. Security and configuration events are written to a durable audit log that survives restarts: role changes, settings changes with a per-field diff, SSO and SCIM activity, identity rejections, and policy blocks.

curl -s "https://<your-agentwatch-host>/api/admin/audit/export?from=2026-09-01&to=2026-09-30" \
  -H "Authorization: Bearer <tenant-admin JWT>" -o audit.json

Retention is configured per deployment; the event archive is written hourly and compressed, and is the compliance record rather than a convenience copy.

How do I answer “did customer data leave our environment?”

1. Usage Insights → filter by the window and by DLP status.
2. Blocked and redacted rows show what policy did. No raw detected value is stored in a preview — actioned rows are scrubbed at write time, so the audit record itself cannot become the leak.
3. Export the window (above) for the auditor.

For shadow AI — traffic that never went through the API — the same question is answered from the endpoint agent’s records, provided content inspection is on.

Who can see what?

Role	Scope
User	Their own usage, keys and budget
Team admin	Their team
Tenant / company admin	Their whole organization, including its settings
Super-admin	Every organization, plus platform-scoped settings

Cross-organization access requires a super-admin by construction — an organization admin acting on another organization’s object is refused at the route, not filtered in the UI.

Hardening checklist

• Keep gateway keys server-side; never ship one to a browser or desktop client.
• Prefer service keys with delegated identity over a shared key, so every request attributes to a person.
• Turn on SSO and disable auto-create if access must be granted deliberately.
• Verify de-provisioning works before you rely on it — disable a test user in your directory and confirm their key stops authenticating.
• Set ENCRYPTION_KEY so secrets at rest are encrypted, and never rotate it on a running deployment without a planned migration.
• Review Settings → Audit Logs for security.* events on a schedule.

Sources and references

• Detection and enforcement detail: Data protection and guardrails.
• Deployment topologies including air-gapped: Deployment.