Security you can check for yourself.
Agents touching your systems is a security question before it is a product question. Here is how LeafCraft protects your keys and data, and where it runs. We claim no certification we don't hold.
Where it runs
Your agents. Your infrastructure. Your data.
Your cloud account
One command deploys to AWS, Azure or Google Cloud, inside your own account.
Your VPC
Keep every call inside your private network.
On-premises
Run it in your own data center with Docker or Kubernetes.
Local models
With local models through Ollama or vLLM, nothing needs to leave the building.
Built in today
What every deployment comes with.
Keys never sit in the config
Keys live in a vault, ours or one of 14 you already use. LeafCraft won't start if one is typed into the config, and no screen or API shows a key back.
Tenants are kept apart
Each tenant's sessions, memory and events are stored separately from every other tenant's.
Encryption in transit
Every call to an outside agent on another host goes over HTTPS. Connections to Redis can use TLS or mutual TLS.
Agents use only what you give them
A tool that isn't on an agent's list is refused before it runs. Code runs in a sandbox with no keys and no network unless you allow it.
Outside agents are fenced in
They reach only the addresses you allow and get only the fields you choose. Keys are never sent to them.
Outside replies read as data
Replies from outside agents and tools are read as data, not orders.
Signed webhooks
Inbound webhooks are signed with HMAC-SHA256, with a timestamp and a one-time code, so a captured request can't be replayed.
Verified senders
Replies over email or Microsoft Teams are checked to come from the right sender before they move any work.
One switch stops everything
Stop pauses the whole operation across every server and cancels work in progress. It holds through a restart.
Identity and access
Every agent has its own login. Never a shared one.
Each agent gets the access of its role, not the access of the person who set it up. Access is set per system, per action (view, create, change, approve) and per data set. Start narrow. Remove access the day a role or an agent ends.
Questions teams ask
Do you hold SOC 2 or ISO 27001 certification?
Our SOC 2 audit is in progress. Ask us for the current status as part of your security review. We don't claim a certification we don't hold.
Does LeafCraft see our data?
LeafCraft runs in your environment. Run records live in your own Redis or Postgres, and keys stay in your vault.
Can we keep customer text out of logs?
Yes. One setting masks message content in traces. Timings, costs and agent names stay visible.
Can we delete data on request?
Yes. One call deletes everything stored for a session, and the deletion itself is recorded with who asked for it.
Discover every agent
You can't govern what you can't see.
LeafCraft connects to your ecosystem and finds every agent you run: the ones vendors shipped inside your software and the ones your teams built. Then each one gets an owner, comes under your rules, or is removed.
Explore the rest of the platform
How it works
From work arriving to the record, step by step
ExploreDiscover every agent
Find every agent you run, then own, govern or retire it
ExploreOne team
AI agents and people in the same roles
ExploreYour rules
Roles, access, checks, authority, escalation
ExploreYour memory
Every decision and both reasons, kept by you
ExploreYour budget
Cost known and capped before work runs
ExploreBring any agent
40+ agent platforms, any model, your stack
ExplorePut LeafCraft through your security review.
We'll walk your security team through the controls, the deployment and the record.