Customer security facts and evidence limits

Repository-backed security facts, local test scope, deployment prerequisites, and unresolved assurance questions.

Reading these facts

Evidence review date: 2026-10-20. This page separates implemented repository mechanisms from local tests, deployment configuration, and facts that remain unknown. It is not a certification, customer-specific assessment, legal opinion, or contract. New work described here has not been deployed or exercised against a customer database by this review.

Implemented means code exists in the reviewed checkout. Tested identifies the bounded verification actually run. Configured requires evidence from the particular deployment, not a default or an environment-variable name. Unknown means not established by this review; it must not be converted into a promise.

Security evidence ledger

Area	Implemented	Tested	Configured	Unknown or not established
Weekly incident evidence access	New GET export reuses credential validation, current workspace membership, tenant selection, and existing evidence-reader capability.	Scoped route tests use real authorization logic with mocked repositories and synthetic sessions. A separate isolated PostgreSQL 14.20 test exercises synthetic source queries under a SELECT-only role.	Tenant credentials, memberships, deployment of the route, and real database grants require operator confirmation.	Deployed PostgreSQL roles/load, end-to-end route access, and all other routes are not established by these tests.
CSV and Slack summary privacy	Weekly projection omits customer content/identities, uses tenant-scoped case pseudonyms, applies spreadsheet formula protection, and emits aggregate Slack text.	Unit tests cover redaction, case aggregation, dates, pagination, malicious CSV prefixes, and generation without network delivery.	No Slack destination or weekly schedule is configured by this feature.	Complete source-data redaction, anonymization, historical completeness, and measured attack prevention are not established.
OWASP Agentic 2026 mapping	Ten published risk categories with bounded partial/gap ceilings, evidence references, and uncovered areas.	Exact category/source and report-behavior regression tests.	Customer policies, observed controls, and covered paths must be assessed per deployment.	No certification, OWASP endorsement, full-category coverage, or attack-prevention rate is established.
Existing activity exports and approvals	Activity CSV and configured approval notifications already exist. The new report reuses the CSV serializer and approval Slack escaping.	This slice adds weekly export tests; notification integration is not tested against a live vendor.	Existing approval channels require their own workspace credentials and enablement.	Weekly delivery, scheduler operation, and delivery SLAs are not implemented here.
Agent signatures and execution review	Enrolled-key action verification, guard decisions, approval binding, and human/quorum controls exist on represented paths.	Repository fixtures are evidence for their tested cases, not universal runtime coverage.	Signature enforcement and the runtime's honoring of decisions must be confirmed for the actual deployment.	Mandatory signatures everywhere, verified employee delegation, universal effect interception, and direct-path closure are not established.
Credential encryption	Application encryption code supports AES-256-GCM and legacy decryption. Integration credential storage attempts encryption.	No encryption-at-rest infrastructure assessment was performed in this review.	Correct key material, secret management, migration, and actual stored formats need operator verification.	Some paths can fall back to plaintext; full encrypted credential storage and infrastructure-wide encryption are not established.
Telemetry minimization	Runtime-event privacy code omits selected content and scans known secret patterns.	Weekly export tests establish output minimization, not universal PII detection in source telemetry.	Collection, retention, access controls, and external processors depend on deployment choices.	Complete secret/PII coverage, absence of all stored sensitive data, and legally guaranteed deletion are not established.
Fleet, Cursor, gateway, and signed artifacts	Related SDK/Hook, remote OSuite MCP tools, and catalog HMAC mechanisms exist. B3/B4/B5 add designs and an isolated prototype only, not live authority.	Offline synthetic identity/delegation/gateway checks; no real IdP, TLS, fleet, Cursor, general MCP gateway, or publisher verifier qualification.	No managed fleet, local Hook, identity issuer, or vendor gateway is enabled by this evidence slice.	Operational designs are not implementations. ID-JAG remains an Internet-Draft, not an RFC. Catalog HMAC is not publisher-signed executable provenance or revocation.

Weekly case ids are pseudonyms, not anonymization. Dates, counts, and correlated cases may still be sensitive. A report's held, blocked, and redacted categories can overlap. Stored markers or counters indicate recorded processing, not proof that a breach or attack was prevented. Action records expose their current status; late arrivals, updates, and retention can change a historical rerun.

Configuration and data handling caveats

Do not infer that secrets are always encrypted from the presence of encryption code. Existing integration storage can fall back to plaintext when encryption is unavailable; the managed runtime package installer also writes secret-bearing environment files. Review the exact installation path, permissions, secret store, and actual stored format. This page does not claim that separately owned SDK changes have repaired every credential path.

Raw prompts, action context, tool results, or other sensitive fields may exist in other application records. A redacted weekly export does not prove that the underlying database is content-free. Existing source queries for this report are read-only, but shared session authorization helpers can invoke legacy schema initialization. This review made no customer or production database operations. The isolated PostgreSQL check does not qualify production query cost: output row caps do not bound scan/sort work, and export timeouts/concurrency limits still need operational review. A tested cursor-binding fix preserves microseconds in paginated source reads; it is not broader database security certification.

When configured, semantic guardrail evaluation can submit action context to an external model endpoint. Existing approval notifications can send review content to configured providers. Neither code presence nor use of an API establishes the provider's retention, training, residency, or confidentiality terms. Confirm the actual enabled processors and contracts before transmitting customer data. The new weekly Slack generator itself performs no send or scheduling action.

Assurance and contractual questions

Question	Current fact
SOC 2 report or certification	Not established by this repository review. No SOC 2 certification claim or assurance report is supplied by this page. Obtain any applicable report directly from its authorized owner and verify scope and dates.
Certified ISMS / ISO 27001	Not established. An ISMS policy or a framework mapping is not certification; no certificate is asserted here.
Data region and residency	Unknown for a particular customer. Application modes or example URLs do not prove a region. Confirm hosting, replicas, backups, logs, support access, and each processor.
Model training or no-training promise	Unknown without the applicable provider settings and executed terms. No blanket training or non-training contract promise is made.
DPA, subprocessors, retention, deletion, incident notice, SLA, or RTO/RPO	Not established by these code and unit-test results. Obtain approved current documents and deployment-specific evidence from the responsible owner.
Published plans, SSO placement, and entitlements	Commercial tiers remain unchanged. This page makes no new entitlement or pricing decision.

Evidence locations

The versioned repository ledger is docs/enterprise/customer-readiness-evidence.md; it records exact test commands, file ownership, and remaining release checks. Relevant implementation references are app/lib/workspaceEvidenceAccess.js, app/lib/compliance/weeklyIncidentExport.js, app/api/activity/incidents/export/route.js, app/lib/compliance/frameworks/owasp-agentic-2026.json, app/lib/approvals/approvalNotifications.js, app/lib/notifications/integrationCredentials.js, app/lib/encryption.js, app/lib/runtime/eventPayloadPrivacy.js, and app/lib/llm.js.

Designs and coverage limits are recorded in docs/enterprise/managed-deployment-design.md, docs/enterprise/runtime-coverage.md, docs/enterprise/signed-artifact-design.md, docs/enterprise/workload-identity-design.md, docs/enterprise/delegation-design.md, and docs/enterprise/mcp-gateway-design.md. Exact prototype/SQL checks and remaining independent-review gates are in docs/enterprise/identity-gateway-design-validation.md. These documents and synthetic tests are not evidence of a deployed managed configuration, verified Cursor integration, general MCP gateway, employee delegation service, or publisher artifact verifier. Those claims require separately accepted implementation and deployment evidence.