Security & Trust at Stage

1 · Perimeter

Authenticated, authorized, rate-limited, validated.

• Per-request JWT auth (Clerk) ✅
• Seven-tier RBAC on the authoritative IdP role ✅
• Per-tenant / per-endpoint rate limiting ✅
• Content-Security-Policy enforced (no unsafe-eval) ✅
• Generic error responses — no stack traces ✅

2 · Data

Isolated, encrypted, governed end-to-end.

• Fail-closed tenant isolation at the database layer ✅
• Ingestion validation + pre-context PII scan ✅
• Immutable provenance chain + lineage ✅
• Recoverable deletes + off-site restore-verified backups ✅

3 · AI

Transparent, bounded, provenance-tracked.

• Model-routing ledger, eval-gated by a golden set ✅
• Version-controlled prompts (semver + hash) ✅
• Prompt-injection sanitization + fencing ✅
• Loop / timeout / token / cost guardrails ✅
• Analysis gated to grounded data — Observer until records exist ✅

You can always see which AI did what ✅

Every agent action is logged with the model used, the provider (Anthropic or Google), the reason it was chosen, the exact prompt version, and a fingerprint. "Which AI processed our data, and when?" always has an answer.

Your data never trains the models ✅

Under Anthropic's and Google's commercial API terms, prompts and outputs are not used to train their models, and Stage opts into no data-sharing program.

They can't act on hidden instructions ✅

Text inside uploaded documents is treated as data, never commands. We strip known manipulation patterns and wrap document text in a labeled boundary the model is told to read but never obey.

Important work is double-checked ✅

A second model verifies the first on document extraction; disagreements are held for a human, not auto-published. Nothing becomes your system-of-record without human approval.

They can't run away ✅

Hard limits on orchestration loops, time, and tokens, plus a per-tenant daily spend cap with a soft alert and a hard cutoff, prevent a stuck or abused agent from running up cost or load.

Every answer is traceable ✅

Outputs carry a confidence tier, model attribution, and clickable source citations — each one jumps to the exact record it rests on, so a claim is verifiable in one click, not just labeled. A lineage API replays any result back to the document and upload event it came from. Sage's formatted replies render as escaped React nodes, never raw HTML — so a streamed answer can't carry script.

Sage won't opine without data ✅

An agent's most dangerous failure is a confident conclusion drawn from nothing. Sage's analysis is gated to what your records can support: with no data it stays in Observer mode — raw signals only, no rankings or findings. Its Trust Ladder unlocks stage by stage only as real, grounded records arrive, and every finding is generated from those records and labeled by fidelity — Directional, Grounded, or Portfolio-true — never an inference dressed up as a fact.

Agents stay inside your tenant ✅

Every agent database tool is tenant-scoped at the call site, not just by the global guard — belt-and-braces, so a tool can't read another customer's data even if an upstream filter lapses. Tool inputs are schema-filtered before dispatch, so a stray or hallucinated argument can't derail a valid call, and concurrent turns on one session are serialized so an agent's working history can't be corrupted by a second tab or a reconnect.

Insights must survive a second look ✅

A single model pass can surface a flaky one-off "insight" with the same confidence as a robust one. Cross-domain insights now run several independent generations and only surface a connection that resurfaces across samples resting on substantially the same underlying records — consensus by shared evidence, not matching wording. Each survivor carries how many samples agreed, and model routing itself is pinned by a golden eval set so a change can't silently send a high-stakes financial or lease-legal turn to a weaker model.

What Stage learns about you is governed, not accumulated ✅

Stage distills a small set of working beliefs about your organisation — its culture, workplace needs, and negotiating patterns — so briefs get sharper over time. Every belief is versioned with full history, visible and adjudicable in your Governance console, and labeled with capped confidence: a nightly synthesis can never rate itself above two independent models agreeing, and nothing reaches the top tier without a verified real-world outcome and a named human's approval. New evidence that contradicts a strong belief does not silently overwrite it — it stops and waits for your decision. Belief text is injection-sanitized before it is stored, because anything that conditions a future answer is treated as a security boundary.

It learns only from confirmed records — and pays its own way ✅

The learning passes read only what a human has already reviewed: confirmed meeting extractions, approved documents, and measured outcomes — auto-drafted or unreviewed material never teaches. Deal-level counterparty patterns require at least two confirmed meetings before a belief forms. And every nightly pass is metered in the same audit ledger as interactive AI use, with a fingerprinted, signed output — it spends against your daily cost cap and skips itself when the cap is reached.

Tenant isolation ✅

A global database guard injects a tenant filter into every read and stamps every write — defense across application, database, vector, agent-context, and logging layers. The Postgres row-level-security tenant key is validated before it is set (no injection into the isolation boundary itself), and a CI red-team test asserts cross-tenant reads return nothing before every release.

Encryption

• In transit: TLS 1.2+ end-to-end ✅
• At rest: provider-managed volume/DB encryption ✅
• Tenant-scoped BYOK keys 🟡
• Embedding encryption (with vector backend) 🔲

Residency 🟡

Tenant data and uploads live on Stage's hosted deployment with an encrypted persistent volume. Dedicated-region and single-tenant-instance deployments for enterprise contracts are on the roadmap.

Upload content gate ✅

Every upload is checked by its bytes, not its claimed type: a file that declares itself a CSV or text file but is actually an executable, script, HTML, or archive is rejected before storage. Optional malware scanning can be set to fail closed — an unavailable scanner blocks the upload rather than waving it through.

Outbound request safety ✅

When an agent fetches an external URL (market research, a webhook target, a linked document), an egress guard re-checks the destination on every redirect hop — so a public link that quietly redirects to cloud-metadata or an internal host is blocked mid-flight (SSRF protection), and the blocked internal address is never written to logs.

Recoverable deletes ✅

Deleting core business data is reversible, not instant and permanent. A soft-delete + retention window (default 30 days) removes the row from the product immediately but keeps it restorable until a nightly job purges it — so an accidental or malicious delete can be undone.

Off-site, restore-verified backups ✅

An independent, off-site database copy is exported every cycle, encrypted in transit (https-only) and at rest (AES-256), then restore-verified — loaded back and re-checked by row count and content hash. A corrupt or un-restorable backup is caught on the spot, not discovered in a crisis. This covers loss of the entire primary region, which platform snapshots alone do not.

Mass-deletion circuit breaker ✅

Every bulk hard-delete counts its blast radius first and is refused (fail-closed) and alerted when it would wipe an implausible share of a table — the guard against a bad WHERE clause. An override is explicit and audited.

Lost-update & anomaly guards ✅

Optimistic concurrency (atomic row-versioning) stops two editors from silently clobbering each other's changes — a stale write is rejected with a conflict, never last-write-wins. Row-count anomaly detection across backup cycles flags a table that unexpectedly lost rows.

GDPR & CCPA ✅

Data-subject / consumer rights — access, rectification, erasure, portability — fulfilled via tenant admin tools and a documented runbook. Stage does not sell or share personal information. DPA available on request.

PII detection ✅

Uploaded text is scanned for SSNs, card and account numbers, addresses, and attorney-client privilege markers before any model sees it. You choose the policy: STRICT (quarantine), WARN (allow + log), or PASSTHROUGH (your own DLP).

Deletion & retention ✅

An idempotent six-step cascade removes data from source storage, the retrieval index, caches, and flags affected logs — with a verifiable confirmation. Deletes stay recoverable within a retention window before permanent purge (see Recoverability safeguards). Retention is tiered and tenant-configurable 🟡.

• Acknowledge request ≤ 72 hours
• Document deletion ≤ 7 days
• Full tenant erasure ≤ 30 days

SSO & directory

• SAML 2.0 & OIDC (Clerk Enterprise) ✅
• MFA (TOTP / SMS / passkeys) ✅
• SCIM 2.0 provisioning endpoints 🟡
• JIT provisioning 🟡

Role-based access ✅

A seven-tier role hierarchy (auditor → super-admin) enforced at the API layer, not just the UI, and authorized centrally on the authoritative identity-provider role — a self-set metadata field can't escalate. Maps cleanly to Admin / Operator / Viewer for procurement.

Tenant-admin controls

• Integration enable/disable ✅
• Per-tenant cost caps ✅
• PII scan sensitivity 🟡
• Retention period 🟡
• MFA enforcement / IP allowlist 🔲

Logging & audit ✅

Application, auth, agent-run, model-routing, ingestion, deletion, and access events are logged; records are hash- and signature-protected, and each request carries a correlation ID that stitches its log lines together. Logs are kept clean of secrets and blocked internal addresses. Tenant admins can query their own audit trail.

SIEM export 🔲

JSON / webhook log export for Splunk, Sentinel, and Datadog is on the roadmap; the audit and agent-run schemas are already export-ready.

Vulnerability management ✅

Dependencies are pinned to CVE-safe floors and audited with pip-audit. Patch targets: Critical 24h · High 7d · Medium 30d · Low 90d 🟡.

Continuity & DR 🟡

Independent, off-site, restore-verified database backups run every cycle ✅, SLO latency tracking and health probes are live, and a graceful-shutdown handler drains in-flight work so a deploy or restart can't interrupt a backup or retention purge mid-write. Formal uptime SLA, RTO/RPO targets, and multi-region failover remain on the roadmap 🔲.

Enterprise Security Posture

The authoritative 9-section reference: threat model, isolation, AI security, access control, incident response, and a pre-filled 25-question vendor security questionnaire. ✅ Available

Data Processing Agreement (DPA)

Countersigned DPA with sub-processor list and breach-notification commitments. ✅ On request

Data-handling FAQ & data-flow diagram

Procurement-ready Q&A and a structured ingestion architecture diagram. ✅ Available

Right-to-erasure runbook

The operational deletion procedure with SLAs. ✅ Available

SOC 2 report

Available after certification, under NDA. 🔲 Roadmap

Penetration-test summary

Available after first engagement, under NDA. 🔲 Roadmap