Security
Agents that can only do what you allowed.
Every agent has a written list of what it may do on its own, what waits for a person, and what it was never given. The limits live outside the model, so nothing it reads can talk its way past them.
- Zendesk · Read ticketsOn its own
- Shopify · Read ordersOn its own
- Stripe · Read chargesOn its own
- Stripe · Refund up to $50Asks first
- Zendesk · Reply to the customerAsks first
- Stripe · Delete customersNot granted
- Shopify · Edit or cancel ordersNot granted
- Budget
- $5.00 a week
- Keys
- Restricted, 3 scopes
- Region
- EU (Frankfurt)
Contained by design, not by prompt.
Telling a model to behave is not a control. These six are enforced by Capstan itself, on every step of every run.
- 01
Keys scoped per tool
Each connection gets its own restricted key. An agent sees only the tools you gave it, and only the actions you ticked.
per tool · per action
- 02
A person on every write
Steps that spend money, message a customer or change a record wait for a yes in Slack, Teams or email, with the exact change shown.
rules per step
- 03
Budgets that stop runs
Each agent has a weekly limit. At the limit the run stops mid-step and tells its owner, instead of finishing the job on credit.
per agent · per week
- 04
What it reads can't steer it
Text an agent reads in a ticket, an email or a web page can't change its tools, its limits or who it answers to. Only its owner can.
checked on every step
- 05
Replays write nothing
When you test an agent on last month's cases, every write is caught and recorded instead of sent. Nothing is refunded or emailed.
writes recorded, never sent
- 06
Every step on the record
Each run keeps its trace: what it read, what it decided, who approved what. Admin changes go to a separate audit log.
who · what · when · why
Compliance
Audited by an independent firm every year. Reports are shared under NDA.
SOC 2 Type II
BusinessSecurity, availability and confidentiality, over a twelve-month window.
Request the reportGDPR
All plansA data processing agreement with standard contractual clauses comes with every plan.
Read the DPAPenetration test
BusinessAn outside firm tests the app, the API and agent isolation once a year.
Request the summaryVulnerability disclosure
All plansA published policy, a security.txt file and a reply within two working days.
Report an issue
Identity and access
Decide who can build, who can approve and who can only read.
Roles
All plansAdmin, builder, approver and viewer. Only builders can change an agent.
Passkeys and two-factor
All plansPasskeys or an authenticator app, and an admin can require them.
SAML single sign-on
BusinessOkta, Microsoft Entra ID, Google Workspace or any SAML 2.0 provider.
SCIM provisioning
BusinessPeople join and leave with your directory, roles included.
Domain claim
BusinessAnyone signing up with your email domain joins your workspace.
IP allowlists and sessions
EnterpriseLimit sign-in to your network and set how long a session lasts.
Data protection
Your data stays yours, in the region you choose, and never trains a model.
Encrypted everywhere
All plansAES-256 at rest and TLS 1.2 or later in transit, between every service.
Secrets in a vault
All plansTool keys are encrypted with keys held in a KMS and never shown again after you paste them.
No training on your data
All plansModel providers work under zero-retention terms. Nothing is stored or used to train.
Data residency
BusinessKeep runs, traces and keys in the US or the EU, including backups.
Customer-managed keys
EnterpriseEncrypt your workspace with a key from your own AWS account, and revoke it any time.
Deletion you can check
All plansDelete a workspace and its data is gone within 30 days, backups included, with a certificate.
What we keep, and for how long.
The full list of companies that process your data, and where, is on the subprocessors page.
| Data | Kept for | Where |
|---|---|---|
| Run tracesInputs, steps, tool calls and outputs | 7 days on Free, 90 on Team, 400 on Business | Your region |
| Tool keysAPI keys and OAuth tokens for connections | Until you disconnect, then deleted within 24 hours | Encrypted vault |
| Replay snapshotsThe cases and records a replay read | 30 days after the replay | Your region |
| Audit logAdmin changes, sign-ins, role and key changes | 400 days on Business, custom on Enterprise | Your region |
| Prompts sent to modelsThe text a step sends to a model provider | Not stored by the provider | Zero-retention terms |
| BackupsEncrypted copies of the database | 35 days, rolling | Your region |
Documents for your review
Found a vulnerability?
Email security@capstan.example and you'll hear from an engineer within two working days. Please include:
- the URL or API endpoint, and your workspace ID if you have one
- the steps to reproduce it
- what an attacker could do with it
Research in good faith won't lead to legal action. Our contact details are also in security.txt.
What security teams ask us.
- Do you train models on our data?
- No. Neither do the model providers we use: they process prompts under zero-retention terms and keep nothing after the response.
- Can an agent do something we didn't allow?
- No. An agent's tools, actions and limits are set by its owner and enforced outside the model. If a step asks for an action it wasn't given, the step fails and the owner is told.
- Are you HIPAA compliant?
- Not yet. We don't sign BAAs today, so please don't connect tools that hold health records. It's on the plan for 2027.
- Do you have ISO 27001?
- Not yet. Our SOC 2 Type II report covers the same ground for most reviews, and we're happy to fill in your questionnaire.
- Can we self-host Capstan?
- No. Enterprise workspaces can run in a dedicated tenant in the US or the EU, with customer-managed keys.
- Do you run a paid bug bounty?
- Not a paid program. We credit every valid report on this page, with permission, and we won't take legal action over good-faith research.
Something else on your questionnaire? Send it to us and we'll fill it in.
Sample content: list only the certifications and controls your company actually has.