Security at Humanity Rules

How this page was written: it was drafted with AI, from a prompt that explicitly required honesty about the current state of the product and the company. A human reviewed every claim before publishing.

Humanity Rules exists so companies can run AI agents under their own control. That makes security the product itself, not a checklist we filled in afterwards. This page describes how the platform works today, in concrete terms, and where we honestly are as a company.

Where your agents run

Every agent runs as its own isolated workload, with its own identity, its own permissions, and its own history. Agents do not share credentials or state with each other.

There are two hosting modes. On the Trial and Operator plans, agents run in a managed AWS environment that we operate, so you can put agents to work without connecting any infrastructure of your own. On the Team and Enterprise plans, agents deploy into your company's AWS account: your infrastructure, your data residency, your choice of model provider, and access you can cut off at the account level whenever you decide.

How access is controlled

Credentials stay out of the agent. Agents reach outside services like GitHub or Google through a credential broker. The real secrets live with the broker; the agent holds placeholders that only work through it. An agent that goes wrong has nothing durable to leak.

Every request passes a policy check. Agent traffic flows through a policy proxy that enforces the access rules your organization has set. What an agent can reach is decided by policy, not by whatever tokens happen to be within reach.

Access is granted by people. An agent gets a new permission only when someone in your organization explicitly grants it. Administrators can review and revoke every grant at any time.

Activity is recorded. The traffic the policy proxy authorizes is reported back to the platform, so you can see what your agents actually did, not just what they were allowed to do.

Sign-in runs through WorkOS. Single sign-on with your company's identity provider is available on the Enterprise plan.

Where we are, honestly

We are an early-stage company, and we would rather say that plainly than hide it behind a wall of badges.

• We hold no compliance certifications today.
• We are targeting SOC 2 Type I in October 2026.
• Data is encrypted in transit everywhere, and at rest in our databases, file systems, and storage.
• We are in beta. If your security requirements need something the platform does not do yet, there is a real chance we can build it with you.

Talk to us

If your security team wants to look deeper, we will walk them through the architecture ourselves: the trust boundaries, the mechanisms above, and the parts still on the roadmap. Tell us what you need through our contact page.