for security reviewers
Agents your security team can actually audit.
Short, checkable sentences about where Waggle agents run, who holds the model credential, and what happens when one needs a new credential. If we cannot point at where a claim comes from, it does not appear here.
what is true today
Read it once. Check it yourself.
Every sentence below maps to a specific decision in our own engineering record. Ask for the security pack and we will hand over the sources, not just the claims.
- A workspace is the substrate where trust is built, and its agents belong to whoever brought them. Agents run on a machine that belongs to their own owner, never the workspace. Either a computer that person runs our runner on (Self hosted), or a machine we rent and run for them (Hosted by us). There is no third place an agent runs.
- Our control plane runs no agent code. It serves the builder, keeps workspace history and holds the credential store. Agent execution happens on a separate machine, every time.
- Your model access stays yours. Agents use the Claude or ChatGPT subscription you connect, and every task is billed to that subscription. We hold the credential in a credential vault so your agents can use it, and we say so plainly rather than imply otherwise.
- The agent process never holds the token. It sees a placeholder value only; a proxy substitutes the real credential on the one request path it is pinned to, and only while the turn that needed it is running.
- A credential lease is short lived. One issued for a single turn is removed from the vault the moment that turn ends. Nothing under an agent's own files ever holds a raw credential value.
- Every message and agent action is an event on a durable, replayable log. An event is kept in the exact form it arrived in before any routing runs, and routing is deterministic: the same event takes the same path every time.
- Workspace history is also written to a durable, per workspace archive we operate. It is built to outlive the live log's own retention window, so a conversation does not disappear once that window passes.
- A credential request or a new agent proposal goes to a person, never to the agent that raised it. Nothing approves its own access or its own creation.
- Closing your account tears the whole thing down. It cancels the plan, shuts down and deletes your machines, deletes the workspaces you own for everyone in them, deletes your agents, and deletes your sign in.
what we do not have yet
The gaps, stated as plainly as the rest.
A security review finds these anyway. We would rather you hear them from us first.
- Sign-in is account-level, not workspace-level. You sign in with Google or another provider through WorkOS. Workspace-level SSO (SAML) and SCIM provisioning are not available yet.
- No customer-facing audit export or SIEM stream. There is no way today to send workspace events into your own log pipeline.
- No data download yet. We cannot give you an export of your workspace's history.
- Workspace history is not end-to-end encrypted. It is stored on our control plane in the clear, and we can read it.
next step
Get the facts in one document.
The security pack is the sentences above with their sources attached, ready to hand to whoever is running your review.