Loading…
Loading…
Trust
A posture ledger, not a badge wall. Every row says what is true today, what artifact would prove it, and whether that artifact exists. Where it does not, the row says so. We hold no SOC 2 report, no ISO 27001 certificate, and no third-party penetration test, stated here rather than left out.
Certifications and obligations
A certification claim is only as good as the document behind it, so each row names the document. Four of these rows say the document does not exist.
| Item | Status | Proving artifact | As of |
|---|---|---|---|
| SOC 2 | Not held | A Type I or Type II report from a licensed auditor would prove it. No report exists, no auditor is engaged, and no audit is in progress. We are not going to describe internal work as an audit programme. | 2026-08-05 |
| ISO 27001 | Not held | A certificate from an accredited certification body would prove it. None exists and no body is engaged. | 2026-08-05 |
| HIPAA | Not offered | A signed business associate agreement would be the artifact. We do not sign them and AGI is not offered for protected health information. | 2026-08-05 |
| Third-party penetration test | Not performed | A dated report and remediation letter from a testing firm would prove it. Neither exists. Automated scanning in our own pipeline is described on /security and is not a substitute. | 2026-08-05 |
| GDPR: data subject rights | Implemented | Self-service export returns your account data as a JSON download, and account deletion runs an enumerated erasure across 70 user-scoped tables plus stored objects, on a daily scheduled job. Mechanism is documented on /security; the deletion window is stated in the privacy policy. The figure read 34 until 14 August 2026, while the list had grown to 66, nothing checked it. A test now derives it from the code. | 2026-08-14 |
| GDPR: Article 27 EU representative | Not appointed | A designation naming a representative established in the Union. It has not been made. This is a known open obligation, tracked at /legal/eu-representative, and we are listing it rather than letting you discover it. | 2026-08-05 |
| CCPA / CPRA: access and deletion | Implemented | The same export and erasure paths as above. We do not sell personal information; see the privacy policy for the disclosure. | 2026-08-05 |
| Subprocessor transparency | Published: corrected 14 August 2026 | A list of processors with purpose and region is published at /subprocessors, and processing terms are at /dpa. Stating the correction rather than quietly reissuing the list: a review on 14 August found six recipients missing, including a transactional email provider that had been delisted nine days earlier on the false reasoning that no email package appeared in our dependencies: it calls the provider’s HTTP API directly, so the check could not have found it. The list is now built from egress rather than from the manifest. | 2026-08-14 |
| DPDP (India): notice under s.5 | Published | An itemised notice at /privacy/india naming the fiduciary, each purpose, the recipients, retention, the cross-border position and every data-principal right, with what the product actually does for each. Drafted from the repository; NOT yet reviewed by Indian counsel, and it says so in its own source. | 2026-08-14 |
| DPDP (India): consent under s.6 | Implemented | A per-purpose consent ledger in the database, append-only by database grant and by trigger, so a withdrawal can never overwrite the grant it withdraws. Boxes render unticked, an unticked box is recorded as a decision, and the largest anonymous intake refuses to store an address without an explicit consent row written first. Withdrawal is one click at /privacy/requests. | 2026-08-14 |
| DPDP (India): data principal rights (ss.11–14) | Partially implemented | Export and account deletion are self-serve; consent withdrawal is self-serve at /privacy/requests; access, correction, erasure without an account, and nomination are recorded as durable requests with a reference and worked manually. Nomination has no field in the product. The gaps are stated on /privacy/india rather than implied away. | 2026-08-14 |
| DPDP (India): grievance redressal under s.13 | Published, as a role | A grievance route published in the site footer, on /privacy/india and in the terms, reachable without an account. It names a role rather than an individual because no named officer has been designated: designating one is an open founder decision, not an engineering task. | 2026-08-14 |
| DPDP (India): verifiable parental consent under s.9 | Not implemented | Under this Act a child is anyone under 18 and verifiable parental consent is mandatory. The web surface has no age gate; the mobile age gate is self-declared and its minor-safe mode can be cleared by the child. This is the largest open gap in our DPDP position and we are listing it rather than letting you discover it. | 2026-08-14 |
| DPDP (India): notice languages under s.6(4) | Not provided | The Act entitles a data principal to the notice in any Eighth Schedule language. Only English is published. Translation is a commissioning decision that has not been made. | 2026-08-14 |
| DPDP (India): Significant Data Fiduciary obligations | Not applicable unless notified | Significant Data Fiduciary status is a Central Government notification, not a self-assessment. AGI has not been notified. If it ever is, a named India-based Data Protection Officer, a data protection impact assessment and an independent audit become mandatory, and none of the three exists today. | 2026-08-14 |
| DPDP (India): data residency | Not offered | All hosting is in the United States. There is no Indian region and no plan published for one, so using the service means personal data leaves India. | 2026-08-14 |
Security posture
Mechanisms are explained on /security. This table is the summary a reviewer can scan, including the three rows that say a control is partial or absent.
| Control | State | Detail | As of |
|---|---|---|---|
| Local mode isolation | Implemented | Local chats run on your own hardware and are written to an encrypted database on your disk. No AGI infrastructure and no subprocessor is in the request path. | 2026-08-05 |
| Device encryption at rest | Implemented | SQLCipher is compiled into every desktop build, not an option. New installs key the database with 256 bits from the OS random source, held in the OS credential service and namespaced per build identity. | 2026-08-05 |
| Secret storage | Implemented | Provider keys are sealed with AES-256-GCM under purpose-separated PBKDF2-HMAC-SHA256 keys at 600,000 iterations. The optional master password uses Argon2id at OWASP parameters and cannot be recovered by us. | 2026-08-05 |
| Transport security | Implemented | HSTS with a two-year max-age, subdomains included, preload requested; frame denial, MIME sniffing off, and a restrictive permissions policy on every response. | 2026-08-05 |
| Content Security Policy | Implemented, with one documented exemption | Per-request nonce, no 'unsafe-inline' in script-src, object-src none, frame-ancestors none except owner-scoped PDF preview. Inline styles are still permitted; that exemption is listed as an open item on /security rather than omitted. | 2026-08-05 |
| Artifact sandboxing | Implemented | Model-generated artifacts render on a separate origin with no network egress (connect-src 'none') and frame-ancestors pinned to our hosts. The fallback path drops allow-same-origin rather than weakening the sandbox. | 2026-08-05 |
| Database row-level isolation | Partial: 39 of 154 database-backed hosted API route files | Counted against the 154 route files that reach the database; the other 101 hosted routes touch no database at all and are excluded from both sides rather than used to flatter the ratio. A route that reaches for the owner connection at all is counted against us, even where it also reads under policy. Where bound, queries run under a role that cannot bypass policy with the caller identity set per transaction, and both reads and writes are constrained. The remaining 115 connect as the database owner, which bypasses row-level security by design, and enforce ownership in application code only. The rules those routes must satisfy instead are on /security. | 2026-08-27 |
| Authentication and CSRF | Implemented | Six protected route groups are checked before render; admin routes require an explicit server-side role. CSRF tokens are HMAC-SHA256 with an enforced minimum secret length, constant-time comparison, a rotation window, and fail-closed behaviour when unconfigured. | 2026-08-05 |
| Rate limiting | Implemented | Per-endpoint limits backed by Redis, required at production runtime. Security-sensitive endpoints reject requests when the limiter is unreachable; a small number of business-critical paths are deliberately fail-open and marked so in code. | 2026-08-05 |
| Egress and SSRF controls | Implemented | Private, loopback, link-local, and reserved ranges are rejected before any allowlist is consulted, including IPv4-mapped IPv6 forms. Remote MCP URLs must be HTTPS, publicly resolvable, and free of embedded credentials. | 2026-08-05 |
| Security event logging | Implemented: seven event types | Failed authentication, rate-limit exceeded, failed authorization, suspicious activity, admin action, failed CSRF validation, and invalid signature, written by a single module. There is no hosted per-tool activity journal; the desktop keeps one locally. | 2026-08-05 |
| Account erasure | Implemented and scheduled | Enumerated table sweep, stored objects deleted before their catalogue rows, a completeness flag that refuses to report partial success, erasure ordered before identity deletion, and a daily job that runs it. | 2026-08-05 |
| Release signing | Implemented on macOS and Windows | The macOS workflow fails without Apple signing and notarization credentials and ships a notarized universal disk image. The Windows installer is signed through Azure Trusted Signing and the pipeline blocks if the signature does not verify. | 2026-08-05 |
| Managed Cloud maturity | Public alpha, open by default since 27 June 2026 | Signed-in users can use managed compute now. It is not general availability, and /sla describes targets rather than commitments. Hosted code execution through E2B stays off unless an operator sets an explicit flag. | 2026-08-05 |
| Production access governance | Not implemented | Production database credentials exist and are held by the operator. There is no just-in-time access approval, no periodic access review, and no break-glass procedure. | 2026-08-05 |
| Business continuity evidence | Not published | No recovery point objective, no recovery time objective, and no restore test evidence has been published. Treat continuity as unproven. | 2026-08-05 |
Independent verification
Most of what this page asserts is externally observable. If any of these checks disagree with the tables above, the tables are wrong and we want to know.
Request any page on agiworkforce.com and read Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy. The CSP nonce changes on every request; a repeated value would mean the claim on /security is wrong.
Fetch the sandbox origin directly and read its Content-Security-Policy. connect-src should be 'none' and frame-ancestors should be pinned to our application hosts, not a wildcard.
Download the disk image and run codesign --verify --deep --strict, spctl --assess --type execute, and stapler validate. A notarized, stapled Developer ID signature either verifies or it does not.
Run Get-AuthenticodeSignature on the downloaded installer. Our release pipeline blocks publication unless that check reports Valid, so yours should agree.
This is the claim worth testing, because it is the one that most differentiates us. Put the desktop app in Local mode with a local model and watch the network. Chat traffic to AGI infrastructure should be absent.
/status runs its check when you load it and shows the timestamp. It is not a static badge, and it states exactly which dependencies it does and does not cover.
Change record
| 2026-08-05 | Rewritten as a dated ledger. Removed a claim that SOC 2 evidence collection was underway: no such programme exists. Corrected the code-signing rows, which described signing as planned when both macOS notarization and Windows signing are implemented and enforced in the release pipeline. Replaced the general database-isolation claim with the actual route coverage. Added the unappointed EU Article 27 representative, absent production access governance, and absent continuity evidence as explicit rows. |
| 2026-07 | Retention consolidated to a single enforced answer, and the subprocessor list corrected to include processors that were live but unlisted. |
Related