Security and control
Trust is not a page. It is the product.
An agent with your Gmail is only useful if you can see what it does, price it and stop it. Every control on this page is visible in the product, not only in the terms.
The floor
Eight things an agent never does without a person.
A workspace can tighten an agent's policy. Nobody, including an owner, can loosen it below this list.
- 1Message anyone outside the workspace for the first time
A stranger never hears from your agent until you have seen the message.
- 2Move money, issue refunds or credits
Every payment and refund is a checkpoint with the amount, the recipient and the policy.
- 3Delete or overwrite records it did not create
Agents add and draft. Destroying existing data is a human decision.
- 4Change roles, permissions or its own policy
Nothing an agent produces can widen what it is allowed to do.
- 5Connect an integration or widen scopes
New access is granted by an admin, never requested and self-approved.
- 6Accept terms, sign anything or make a purchase
Agreements and purchases are signed by people.
- 7Publish publicly
Posts, pages and releases wait for a sign-off, whatever the agent's policy says.
- 8Act in another workspace
Tenant isolation is enforced in the application and in the database.
Plus: every new agent's first run is draft-only, whatever its policy says. Write scopes unlock after a person reviews one complete delegation.
Three controls you can feel
See it, price it, stop it.
Approvals show the exact action.
A card is the tool that will be called, the payload it will send, a preview a person can read, the cost, and who else can decide. What the decider saw is stored with the decision as a hash.
- Approve, request changes or reject
- Escalation at the deadline; silence never means yes
- Decisions recorded under the decider's name
Refund $240.00 to order #4821?
Nico · support triager · via Stripe · policy allows within 30 days
Who else can decide: Omar (admin) · expires in 22 h, then escalates
Budgets with hard stops.
Per delegation, per agent and per workspace. At 80 percent the agent files a checkpoint; at 100 percent it stops. It never finishes quietly over budget, and every step's price is shown as it happens.
- Caps set in the composer
- Ask before any single step over a threshold
- Soft and hard limits at the workspace level
- Checkpoint at 80%$40.00
- Hard stop at 100%$50.00
- Ask before any step over$2.00
An append-only record.
Every tool call with its payload, every approval with who decided and what they saw, every policy change. Rows are hash-chained and the chain head ships with exports, so tampering is detectable.
- Insert-only at the database level
- CSV export for audits and clients
- Retention per plan, purge keeps the audit skeleton
- 14:02Mercer sent 41 emails · approved by Yasmin
- 13:58Mercer drafted the update
- 13:51Mercer read 3 Notion pages
- 13:50Yasmin delegated the brief
Append-only · hash-chained · exportable
Under the hood
How the platform is built to hold the line.
Tenant isolation
Every row carries a workspace id. The application refuses unscoped queries and Postgres row-level security enforces it again underneath.
Token vault
OAuth tokens are envelope-encrypted with per-row data keys under a rotating key-encryption key. Plaintext exists only inside the adapter call.
Least-privilege scopes
Connections hold what an admin approved. Each agent gets a subset and requests outside it fail closed.
Untrusted tool output
Everything a tool returns is data, never instructions. Nothing a model outputs can change a policy, grant a scope or approve itself.
Secrets stay secret
API keys and invite tokens are stored hashed. Adapters redact known secret patterns before anything is persisted.
Sandboxed execution
Code runs in isolated containers with no credentials mounted, an egress allowlist and time and memory caps. Results are treated as untrusted.
Encrypted everywhere
TLS 1.2 or better in transit with HSTS, encryption at rest for data and backups, and Cloudflare in front of every request.
No training on your data
Customer data is never used to train models. Inference providers retain API data for up to 30 days; the data processing addendum says so.
Rate limits and WAF
Per-IP, per-key and per-workspace limits, plus a firewall that blocks probes and challenges suspicious traffic before it reaches the app.
Questions
What people ask before connecting an account.
Who can see my agents' transcripts?
Members of your workspace with the right role. Nobody at Delagents reads customer transcripts except with your permission for support, and that access is logged.
Where is the data hosted?
On Cloudflare's network and a managed Postgres provider in the EU region for the preview. Regional hosting choices are on the roadmap for the Business tier.
Do you have SOC 2?
Not yet. The audit log, tenant isolation and vault are built for it from day one, and the audit starts when the first Business customer needs it.
What happens when I delete a workspace?
Customer content and files are purged after a short grace period. The audit skeleton, without payloads, is kept for the retention your plan specifies.
Can I report a vulnerability?
Yes. Write to hello@delagents.com with the details and we will respond within two business days.
Hand it off.
Your first delegation takes a minute. Your first sign-off takes a second.