Security

Your data, your keys,
your rules.

Harnyss runs on your own AI keys and accounts, inside your systems, with every run on record. Here is how your data is protected, and what we have not done yet.

Controls

How your data is protected

Your own AI keys

Live

Agents run on Claude with your own Anthropic API keys, plus OpenAI for images and search and BytePlus for video, so model usage and billing sit in your accounts. Stored keys are encrypted with AES-256-GCM.

Not used to train models

Live

We do not use your data to train our own models. Your AI provider’s terms govern the data you send it; the Anthropic API does not train on API data by default.

Encrypted at rest and in transit

Live

Data is encrypted at rest with AES-256 and in transit with TLS. Credentials for the tools your agents use are encrypted separately with AES-256-GCM.

Isolated by workspace

Live

Each company’s agents, memory, workflows and data live in its own workspace, separate from every other customer’s.

Access you control

Live

Owner, admin and member roles, with access set per agent for each person, and two-factor sign-in with an authenticator app.

Read-only databases by default

Live

Database connections are read-only unless you allow writes, and every query runs with row and time limits.

Approvals and a full run history

Live

You decide which work needs sign-off before it happens. Every run is on record: which agent did what, when, and what it cost.

SOC 2

Planned

The controls on this page are in place today. A SOC 2 audit is planned; we will not describe Harnyss as SOC 2 compliant until an independent auditor has issued a report.

Disclosure

Reporting a security issue

We welcome security research and disclosure from the community. If you believe you've discovered a vulnerability affecting Harnyss, please report it to security@harnyss.ai.

Scope.In scope: the Harnyss platform at app.harnyss.ai and its APIs. Out of scope: third-party services we integrate with (please report those to the vendor directly), denial-of-service testing, social engineering of Harnyss employees or customers, physical attacks, and findings on systems you don't own or have explicit permission to test.

What to expect. We acknowledge reports within one business day and provide an initial assessment within five business days. Critical issues affecting customer data are remediated within seven days; lower-severity issues within thirty days.

Safe harbor. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, give us a reasonable opportunity to remediate before public disclosure (90 days by default), and only access data necessary to demonstrate the issue. Researchers acting outside these guidelines do not receive safe-harbor protections.

We currently do not operate a paid bug bounty programme, but we credit researchers who request it in our public security advisories.

Security questions?

We're happy to answer a security questionnaire, take specific questions, or schedule a technical review with your security team.

Contact security team