Skip to content

Start building

MyDeepAgentsMyDeepAgents

Security

Security is the core, not a feature

Agents read your systems and act in them, so the platform was designed around isolation, encryption and approval from the first line. Here is how it protects your data, and how to tell us if you find a problem.

Report a vulnerability

Architecture

A rigid core, so everything else can flex

One row belongs to one tenant. One transaction works in one tenant. Keys are per tenant. The flexible parts are safe because the core never bends.

  • Isolation the database enforces

    Every query runs in one tenant’s context, and row-level security checks it again. It fails closed.

  • Your keys, your cloud

    Bring your own keys and storage on AWS, GCP or Azure. Delete a tenant’s key and its data is gone.

  • Secrets never reach the model

    Credentials are decrypted only at the moment of the outbound call. Never in a prompt, never in the browser.

  • Untrusted code runs alone

    Custom code runs in an isolated Lambda sandbox with nothing to steal, never inside our workers.

  • Every outbound call is checked

    An egress proxy blocks internal addresses, pins DNS and allows only each connector’s hosts.

  • An audit trail for everything

    Who did what, as whom, and on whose behalf. Kept up to six years and immutable under HIPAA.

Compliance

Pick a compliance profile for each agent

Standard, Privacy or HIPAA. The policy engine enforces the profile at five choke points, so feature code never has to remember the rules.

  • Standard

    Made for For most products. Strong defaults, nothing in your way.

    Model routing
    Any provider you enable
    Member sign-in
    MFA optional
    Run content
    Encrypted at rest
    Logs and traces
    IDs and metadata only
    Audit log
    Kept 1 year
    Widgets
    Anonymous sessions allowed

  • Privacy

    Made for For personal data under GDPR and similar laws.

    Model routing
    No-training providers, region pinned, optional PII redaction
    Member sign-in
    MFA recommended, SSO available
    Run content
    Field-level encryption, retention limits, export and delete per person
    Logs and traces
    IDs only, plus a PII scrubber
    Audit log
    Kept 2 years
    Widgets
    Consent notice shown

  • HIPAA

    Separate cell

    Made for For health data, in a separate cell with its own AWS account.

    Model routing
    BAA-covered endpoints only, Claude on Bedrock by default
    Member sign-in
    MFA and SSO required, 15-minute idle timeout
    Run content
    Field-level encryption, every read audited
    Logs and traces
    Content only in encrypted tables
    Audit log
    Kept 6 years, immutable
    Widgets
    Signed user identity before any PHI tool

In practice

The details people ask about

Where the platform runs, how sessions behave, and who on our side can reach your data.

Hosting
Amazon Web Services, United States (us-east-1). HIPAA tenants run in a separate cell with its own AWS account.
Encryption
TLS for everything in transit. At rest, envelope encryption: data keys sealed by a key per tenant, sealed by a key in KMS.
Sign-in
Single sign-on and multi-factor sign-in, required under the HIPAA profile. Social sign-in with Google, Microsoft, Apple, Amazon and Meta.
Sessions
Sealed, httpOnly cookies that scripts cannot read. A session ends after 12 hours idle and 14 days at most, and you can end any of them from your account.
Connections
Tokens for connected tools are encrypted, decrypted only for the outbound call, and never shown to a model or a browser.
Our access
Limited to the people who run the service, for support you ask for, security or the law, and every access is logged.
Subprocessors
The companies that help us run the service are listed on one page, with what each does and where.See the subprocessors

Disclosure

Report a vulnerability

If you find a security problem in MyDeepAgents, tell us privately and give us a fair chance to fix it. We are glad to hear from you.

How to report

  1. Email khurram@mydeepagents.com with the subject “Security report”.

  2. Describe the problem, where it is, and the steps to see it. A short proof of concept helps.

  3. Tell us how to credit you, if you would like to be credited.

Email a reportsecurity.txt

Please

  • test only against accounts and data you own;
  • stop and tell us as soon as you reach someone else’s data;
  • never degrade the service, send spam or try social engineering;
  • keep the details private until we have fixed the problem.

Our promise

We will confirm that we received your report, keep you told as we work on it, and credit you if you wish. If you act in good faith and follow these rules, we will not take legal action against you for your research.

Out of scope

  • Denial of service and load tests
  • Reports from automated scanners without a working proof
  • Missing headers or settings with no security impact
  • Social engineering and physical attacks

Questions

Need more detail?

If your security team has questions this page does not answer, write to us and we will go through them with you.

Contact usRead the privacy policy