Skip to content
Second Key Security

Security and trust

Written for your security team: what the agents we build in your environment can reach, where they run, what happens to your data, and how every change is approved.

Five commitments

  • Runs in your environment

    Agents run in your cloud or on your servers, under your accounts.

  • Read-only by design

    You create the credentials and the roles, and your own IAM enforces them. We design least-privilege scopes for each service, for example the AWS SecurityAudit policy rather than ReadOnlyAccess, and we prefer short-lived credentials. You can revoke access at any time.

  • Your model, your contract

    The agents use an AI model provider account you own, under your contract with that provider.

  • Nothing changes without your key

    Every change needs your approval. Approved changes run with a separate credential you issue for that change, so we hold no standing write access.

  • Full visibility and a stop button

    Every action is logged in your environment, so you can see exactly what agents read and did. Revoking one account stops everything.

In detail

Access model

You create the credentials and roles. We design least-privilege scopes for each service, for example AWS SecurityAudit rather than ReadOnlyAccess.

Short-lived credentials are preferred wherever your platform supports them.

Where agents run

In your cloud or on your servers.

Data handling

The agents work inside your environment, on access you create. When the engagement ends, we delete the client data we hold.

Change control

Approved changes run with a separate credential you issue for that change. Every action is logged in your environment.

Our own security

MFA on every account, encrypted devices, and an NDA on request.

Your security questionnaire

For your vendor review.

Email us from your company address and we will answer your security questionnaire.

Email hello@secondkeysecurity.com