Security & Compliance
Built so you have good answers — even without a CISO.
Pantheon OS is the governed AI workspace — every action logged, every secret encrypted, every approval recorded.
Encryption at rest
Secrets — OAuth tokens, bot tokens, BYOM keys — are envelope-encrypted (AES-256-GCM) before they reach the database, in a versioned format built for key rotation. Database storage is encrypted at rest by managed Postgres (Supabase).
Encryption in transit
TLS is terminated at the hosting edge and managed by the provider — we do not pin a version, so we do not claim one. HSTS, CSP and X-Frame-Options are enforced by us on every response.
Tenant isolation
Every query is owner-scoped at the application layer — tenant identity is ambient per-request, not a parameter callers can get wrong — with Postgres RLS as defense in depth. Isolation is CI-tested; regressions block merge.
Secrets
Connector tokens and provider keys are decrypted only at the moment of use and never returned by the API — the profile endpoint answers 'key set: yes', never the key.
Audit trail
Every agent action, tool call, and approval is appended to a per-tenant hash chain computed in the database — any edit breaks verification, and you can run the verify check via API anytime.
Approval gates
Destructive actions require human approval via web, CLI, or Telegram — and the gate fails closed: if its own plumbing breaks, the action blocks rather than proceeds.
Evidence re-checked before execution
Consent is not the same as currency. Before an approved action runs, Pantheon re-reads the decision context it was planned against and diffs it: a changed status, a newer source timestamp, or a vanished record stops the action and shows the approver exactly what moved. The comparison is against the synced context graph from your connected tools — so when that sync is older than the freshness threshold the verdict is 'cannot confirm', never a false all-clear, and it still blocks. A failed check blocks too. The verdict, including whether a human acknowledged the drift and proceeded, is sealed in the hash-chained record with the action.
Policy as code
Policies live in your repo as YAML. Diff in PRs. Review in code review. Unclassified tools require approval by default.
Off switch
Pause an agent, a connector, or the entire workspace in one click. The record is append-only — turning things off never edits history.
Evaluating agent products? We published the checklist we'd want to be judged by — 13 things to verify before an AI agent touches your tools, including the two checks we don't fully pass yet.
Compliance roadmap
- SOC 2 Type I — on the roadmap (not yet certified)
- GDPR — DPA available on request
- HIPAA — on the roadmap. No BAA is offered today.
- Open Agent Record — open, signed, portable record of agent actions and approvals, built to map to EU AI Act record-keeping and SOC 2 evidence (open spec, in development)