What AgentBrain guarantees, and what it does not
Each control below carries an evidence label. “Implemented” means the code exists; it does not mean production-supported or independently assessed.
Last reviewed: 2026-10-28 against agentbrain-app main
How to read the labels
- ImplementedThe capability exists in the product code.
- TestedAutomated tests cover the capability's behavior.
- Production-supportedWe run and support it in a stated deployment.
- Independently assessedA third party has assessed it for a stated scope. Nothing holds this label today.
- PlannedOn the roadmap. Not available.
- Not supportedNot available and not on a committed plan.
Deployment assumptions
Guarantees on this page assume the deployment named next to them.
- Managed cloud on our Kubernetes infrastructureProduction-supported
Our standard deployment. We operate the database, workers and MCP server.
- Private deployment on your infrastructurePlanned
Container images exist. A packaged self-hosted release (Helm, on-prem database guide) is planned; today private deployments are scoped and run as projects.
- Air-gapped operationNot supported
Sign-in uses the builder-auth service, and default AI providers are external APIs. Both need network access.
AI egress is separate from where the database lives
Hosting the database in a given place does not keep content there. Content leaves the deployment whenever it is sent to an external AI model, embedding provider, MCP client or API consumer, unless you block that path.
- External LLM and embedding providers
- Prompts, retrieved passages and documents sent for embedding go to the provider you configure, under that provider's terms.
- AI governance modes
- Per organization, external AI traffic can be monitored, redacted or blocked at each egress point (LLM calls, embeddings, media, graph extraction, MCP rows).
- Self-hosted models
- OpenAI-compatible endpoints you run yourself, such as vLLM, can replace external providers.
- MCP clients and API consumers
- Whatever an assistant retrieves leaves AgentBrain and is governed by that assistant's own terms. Provider allowlists and data residency rules are planned.
Security controls and their status
Integration tests for audit and permissions exist and need a PostgreSQL environment to run.
- Organization and resource permissionsImplemented
Users, roles and groups; department subtrees; per-resource grants; row filters.
- Permission checks for MCP requestsImplemented
The MCP server delegates checks to the backend. Agent task and workflow run checks over MCP are not supported yet, and knowledge graph entity grants use a narrower check.
- Append-only audit logTested
Enforced by database privileges and triggers, with tests. No hash chain, so a database superuser outside the app could still alter records.
- Audit retention and legal holdImplemented
Retention 30–3,650 days per organization, with legal hold.
- AES-256-GCM encryption of stored credentialsImplemented
Single application key. No per-tenant or customer-managed keys.
- AI egress monitor, redact and block modesImplemented
Deployed to staging and production in 2026.
- Human approval checkpointsImplemented
Approve, reject or cancel with approver groups. Email and Slack delivery of approval requests is not built.
- SAML / OIDC / LDAP federationPlanned
Sign-in today is through builder-auth.
- SIEM export and OpenTelemetry tracingPlanned
Prometheus metrics exist. No audit export sink or tracing is wired.
- Customer-managed keys (BYOK / KMS)Not supported
Not available.
What we handle and what you handle
AgentBrain (product and managed service)
- Enforce configured permissions on search, retrieval and MCP requests
- Keep the audit log append-only for the application role
- Encrypt stored connector credentials and provider keys
- Operate managed-cloud infrastructure and apply updates
You (customer)
- Decide who gets which roles, groups and grants
- Choose AI providers and set egress modes to match your policies
- Review the terms of each AI provider and MCP client you connect
- For private deployments: host, patch, back up and secure the infrastructure
Certification status
No certification or third-party assessment exists today. We will name the scope and auditor here when one does.
- ISO 27001Not supported
No certification and no claim of alignment.
- GDPR / PDPANot supported
No compliance claim. Data processing terms can be discussed per contract.
- HIPAA / FedRAMPNot supported
Not designed or assessed for these programs.
External provider risks
These services may process your content depending on configuration.
- AI model and embedding providers
- OpenAI, Gemini, BytePlus and others you configure receive the content you send them.
- Identity service
- builder-auth handles sign-in and holds user identity data.
- Connected sources
- Connectors read from your databases and storage with the credentials you provide.
- Notification channels
- Telegram and Lark receive the content of workflow notifications you configure.