Security & Compliance
A release gate is only as strong as its failure behavior.
Pantheon binds workspace identity, source evidence and approval provenance before a production side effect, then preserves the observed result.
Application-layer encryption
OAuth tokens, bot tokens and BYOM keys are encrypted with AES-256-GCM before database storage, and production refuses plaintext secret writes. Today one application-held environment key performs that encryption. This is not yet a managed-KMS envelope or an isolated enterprise credential broker.
Encryption in transit
TLS is terminated at the hosting edge and managed by the provider — we do not pin a version, so we do not claim one. HSTS, CSP and X-Frame-Options are enforced by us on every response.
Tenant isolation
Every query is owner-scoped at the application layer — tenant identity is ambient per-request, not a parameter callers can get wrong — with Postgres RLS as defense in depth. Isolation is CI-tested; regressions block merge.
Credential-custody boundary
Connector tokens and provider keys are not returned by the API, but the current API process can decrypt stored credentials when an operation needs them. Until the isolated custody gate passes, production design-partner paths must use provider-native controls, reviewed customer-held execution or least-privilege expiring sandbox authority.
Audit trail
Governed consequential actions and approvals append to a tenant-scoped hash chain computed in the database. Any later edit breaks chain verification. OAR v0.1 links decision and outcome; independent signatures and the complete portable specification remain in development.
Approval gates
Supported consequential mutations enter the Action Kernel and require the applicable human or policy authority. If required policy, evidence, approval or audit plumbing is unavailable, the action blocks rather than proceeds.
Evidence re-checked before execution
Consent is not the same as currency. Before an approved action runs, Commit Guard re-reads supported authoritative evidence and compares it with the approved snapshot. Changed, missing, stale or unavailable required evidence holds the action. Direct source revalidation is currently implemented for GitHub; other sources must not inherit that claim. The result and any explicit acknowledgement are recorded with the action.
Hardened outbound requests
Customer-configurable outbound HTTP uses HTTPS, resolves and pins the destination, rejects private and reserved addresses, refuses cross-origin credential forwarding, caps responses and treats possible-write timeouts as uncertain until reconciled. Fixed-provider SDK paths are separately inventoried.
What is not yet claimed
Pantheon is not SOC 2 certified, has not completed an independent penetration test and does not yet claim hosted enterprise credential custody. The next security gate separates the control plane from a managed-KMS-backed execution broker and proves rotation, revocation, tenant binding and secret non-disclosure.
Policy as code
Policies live in your repo as YAML. Diff in PRs. Review in code review. Unclassified tools require approval by default.
Off switch
Pause an agent, a connector, or the entire workspace in one click. The record is append-only — turning things off never edits history.
Read the current credential-custody limitation before connecting production systems. Pantheon will publish the implemented deployment modes and verification evidence as that gate closes.
Evaluating agent products? We published the checklist we'd want to be judged by — 13 things to verify before an AI agent touches your tools, including the two checks we don't fully pass yet.
Compliance roadmap
- SOC 2 Type I — on the roadmap (not yet certified)
- GDPR — DPA available on request
- HIPAA — on the roadmap. No BAA is offered today.
- Open Agent Record — open, signed, portable record of agent actions and approvals, built to map to EU AI Act record-keeping and SOC 2 evidence (open spec, in development)