SECURITY POSTURE · v0.1 SOC 2 TYPE II · GDPR · HIPAA-READY
SECURITY & PRIVACY

Your accounts.
Your control.

Cevran works inside your perimeter, not around it. Three commitments shape every run: review-first for irreversible work, scoped access for every connector, and zero credentials in the conversation layer.

THREE COMMITMENTS

Defaults. Not upsells.

01 · REVIEW-FIRST Sensitive actions wait for you.

Sending mail, moving money, deleting records, deploying code, escalating tickets — anything irreversible is drafted and queued. Approve to release.

DEFAULT · TUNE PER TOOL
02 · SCOPED ACCESS I see only what you ask me to.

Every connector requests the narrowest OAuth scope it needs. Your workspace context is the perimeter — no cross-tenant reads, no above-seat access.

OAUTH · WORKSPACE-BOUND
03 · NO CREDENTIALS IN CHAT Tokens never reach the model.

Credentials live in the connector layer. The model sees a function name and a result; never the key behind it. Manual keys are vaulted and rotated.

VAULTED · ROTATED · AUDITED
THE TRUST BOUNDARY

Where the model sits.
And where it doesn't.

The conversation is one surface. Your connectors are another. They communicate through a typed function-call interface — never through raw credentials.

LAYER · 01 Conversation
USER INPUT
PLAN
FUNCTION CALL: NAME + ARGS
TOOL RESULT (REDACTED)
REPORT
The model layer. Sees only what's needed to plan and respond.
LAYER · 02 Connector runtime
TOKEN VAULT · KMS
SCOPE ENFORCEMENT
RATE LIMITS · QUOTAS
REVIEW QUEUE
AUDIT LOG
The trust boundary. Credentials live here; the model can call through it but never read it.
LAYER · 03 Your tools
GMAIL
SLACK
SALESFORCE
GITHUB
… + 3,243 MORE
Your accounts, your data. We touch them through OAuth, scoped to the seat.
ANATOMY OF A CALL

From sentence
to side-effect.

Six steps between you typing and a thing happening in the world. Every step is logged, every credential is sealed.

We optimize for the path that's hardest to abuse: the model proposes a typed call; the runtime verifies, scopes, and rate-limits it; the world only changes after you (or your policy) signs off.

01

You write a sentence.

Your message hits the conversation layer alongside workspace context — never your stored credentials.

02

The model proposes a typed call.

Output is a structured intent: gmail.compose({to, subject, body, review:true}). No tokens. No URLs to your accounts.

03

The runtime checks scope & policy.

Does this seat have gmail.compose? Is the recipient inside the allowed domain? Is the call under the per-tool quota?

04

If sensitive: queue for review.

Anything irreversible (send, pay, delete) pauses here. You see a diff of exactly what will happen — and approve, edit, or reject.

05

The connector executes.

The runtime injects the vaulted token, hits the upstream API, and captures the response. The token never leaves the runtime.

06

Result returns to chat — redacted.

PII and secrets are stripped before the result enters the model context. The audit log keeps the unredacted version, gated by role.

COMPLIANCE & ATTESTATIONS

Audited where it matters.

Reports are available under NDA. Trust center, sub-processor list, and current status live at trust.cevran.com.

SOC SOC 2 Type II RENEWED Q1 2026
GDPR GDPR · DPA EU + UK
HIPAA HIPAA-Ready BAA AVAILABLE
ISO ISO 27001 IN PROGRESS · Q3
CCPA CCPA CALIFORNIA
SBOM SBOM published CYCLONEDX · MONTHLY
DATA PRACTICES

What we store. What we don't.

A plain-English summary. The full DPA is the source of truth.

STOREConversation transcripts

Encrypted at rest with AES-256, scoped to your workspace, retained for the period you set (default: 90 days). Workspace owners can purge any time.

STOREAudit log of tool calls

Every function call, with arguments, result codes, and approver. Kept for the audit retention you choose. Exportable to your warehouse on Team.

STOREOAuth tokens · vaulted

In a KMS-backed secret store, never in plaintext, never in our logs. Connectors fetch by reference at execution time; tokens never touch the model.

STOREWorkspace config & policy

Approval thresholds, allow-lists, custom voices. The smallest amount needed to run your account.

DON'TTrain models on your data

Your prompts, content, and tool results are not used to train shared models. Period. BYOK customers can route to their own model endpoints entirely.

DON'TShare data across workspaces

Each workspace is a hard tenant boundary. Cross-tenant access is technically impossible from the application layer.

DON'TRead raw credentials

Even our engineers can't read your OAuth tokens or API keys. The KMS gates everything; access is logged and reviewed.

DON'TSend to third-party LLMs by default

You pick the model provider per workspace. Default is in-region inference; cross-border routing is an explicit setting.

SECURITY FAQ

The questions we get asked.

Can Cevran take an action without my approval?
Only the actions you've explicitly allowed without review. By default, everything that mutates external state is review-first. You can lower the threshold per tool (e.g. "Slack messages don't need review") or raise it ("review every action over $50").
Where does inference run?
In our SOC 2 environment, by default. Enterprise customers can route to their own model endpoints (Azure OpenAI, Bedrock, or self-hosted). Region pinning is available on Team.
What happens if a connector misbehaves?
Rate limits and per-tool quotas catch runaway calls. Anomaly detection on the audit stream raises alerts to workspace admins. Connectors can be disabled per-seat without affecting others.
Can I bring my own model and keys?
Yes, on Team. Bring Anthropic, OpenAI, Google, or a private endpoint; bring your own KMS for the token vault if your security team requires it.
What's the breach disclosure timeline?
72 hours for any confirmed incident materially affecting your data, by direct email to the workspace owner and on the trust center. We post post-mortems for every Sev-1 within 7 days.
How do I delete everything?
Workspace owners can purge transcripts, audit logs, and revoke all connectors from a single screen. Deletion is propagated to backups within 30 days, attested at the next SOC 2 review.
TALK TO US

Bring your security
team. We've met theirs.