Security
Agents that act on real systems need real controls.
Scoped access, human approvals and a full audit trail are on by default. Here is how VegaStack deploys, what agents can reach, who signs off and what happens to your data.
Deployment options
Run VegaStack where your policies need it. Both options carry every control on this page.
VegaStack-managed cloud
We host and operate the platform for you. It's the fastest way to get a first workflow live, with no infrastructure work on your side.
Your own cloud account
The platform runs inside a cloud account you own, so workflow data stays in your environment and behind your network controls.
Access control
Agents get the access their job needs and nothing more.
Scoped credentials
Each agent connects with its own credentials, scoped to the tools and records its workflow uses.
Least privilege
Agents start with the narrowest access that works. Broader access is a deliberate change, never a default.
Per-workflow permissions
Permissions are set per workflow, so an agent that handles invoices can't reach your ticketing system.
Roles for your team
Decide who on your side can build, approve or change a workflow.
Human approvals
You decide which steps need a person. The agent prepares the work and a human signs off.
Approval thresholds
Require sign-off by amount, action type, customer or confidence. Below the threshold the agent proceeds; above it, it waits.
Escalation
If an approver doesn't respond in time, the request moves to the next person you name.
Context in one place
Approvers see what the agent wants to do, why, and the data it used before they decide.
No silent yes
A pending approval never times out into a yes. The agent waits or stops.
Audit logging
Every action an agent takes leaves a record you can read, search and export.
Every tool call
Which system the agent touched, what it sent and what came back, with a timestamp.
Every decision
The step the agent chose and the inputs it used, so a reviewer can follow what happened.
Every approval
Who approved or rejected each request, and when.
Exportable
Export logs to your own audit, retention or monitoring systems.
Data handling
Your data is used to run your workflows, and for nothing else.
Only what a workflow needs
Agents read the systems and fields a workflow uses. Nothing is collected just in case.
Not used for training
Your data isn't used to train models, ours or anyone else's.
Retention you control
You decide how long run data, logs and documents are kept.
Deleted on request
Ask us to delete your data at any time, or at the end of your contract, and we will.
Model providers
Agents use large language models from established providers, through their enterprise APIs.
Enterprise APIs only
We call models through providers' business APIs, never through consumer chat apps.
No training, minimal retention
Where a provider offers no-training or zero-data-retention terms, we use them.
Your provider rules
If your policy requires a specific provider or region, we build your workflows to fit it.
Disclosed up front
We tell you which providers a workflow uses before it goes live.
This website
vegastack.com follows the same habits as the platform.
Hosted on Cloudflare
Served from Cloudflare's network over HTTPS only, with HSTS.
Security headers
A Content Security Policy that allows only our own scripts and Cloudflare Turnstile, frame blocking, a strict referrer policy and a Permissions-Policy that turns off camera, microphone and location.
Bot protection
The demo form is protected by Cloudflare Turnstile and checked on the server before anything is sent.
No trackers
The site loads no analytics, advertising or cross-site tracking scripts.
Compliance
We don't display badges we haven't earned. During your evaluation, we show you how our controls work instead.
Security questionnaires
Send us your questionnaire. We answer it in writing, specific to how your workflows would run.
Controls walkthrough
We walk your security team through access, approvals, logging and data handling. If your review uses a specific framework, we show how our controls map to it.
Responsible disclosure
Found a vulnerability in vegastack.com or the platform? Email founders@vegastack.com with the subject “Security”.
What to include
- What you found and where: the URL, page or component
- Steps to reproduce it, with any proof-of-concept code
- The impact you think it has
- How we can reach you for follow-up
What we commit to
- We acknowledge your report within 3 business days
- We keep you updated while we investigate and fix it
- We tell you when the fix is live
Safe harbour
If you research in good faith, we won't pursue legal action against you. Good faith means you test only against accounts and data you own, avoid privacy violations, data destruction and service disruption, don't use social engineering or denial-of-service attacks, and give us reasonable time to fix an issue before you disclose it publicly.
Bring one workflow. We'll show you the agent.
A 30-minute call. Bring the process that eats your team's week, and we'll walk through how an agent would run it.