Built so your security review is short.
Agents are autonomous software. They need broad access to be useful — and that access has to be controlled, auditable, and revocable. Below is what we ship by default, without asking you to wire it. Every mechanism is named. If something here is wrong or incomplete, email security@launch.ist and we'll correct it.
What we ship by default
The six mechanisms most security reviews land on. Stated plainly so we don’t waste your team’s afternoon.
Session A leaked token outlives the support ticket. Briefly.
Every agent session gets fresh credentials. They expire in minutes, not months. The blast radius of a leak is bounded by the clock. Long-lived keys never leave the secrets engine. The agent works with the short-lived credentials; those credentials cannot outlast the task they were issued for.
- SOC 2
- OWASP
- NIS2
Tenancy One tenant cannot read another.
The policy engine rejects cross-tenant access before the request reaches storage. Per-entity encryption keys mean that gaining access to one tenant’s ciphertext produces nothing useful for another. Every cross-tenant access attempt is audited per call.
- GDPR
- ISO 27001
- HIPAA
Erasure Right-to-erasure that actually erases.
A deletion request destroys the encryption key for that entity. The ciphertext remains in storage and becomes mathematically unrecoverable — including from replicas and backups — in seconds. There is no scrubbing job, no async queue to wait on, no replica lag to account for. The key is gone; the data is gone.
- GDPR
- EU AI Act
Provenance A trail that outlives the run.
Every read, write, and revocation is signed and replayable months later. The trail is not a log you grep; it is a record you can re-run against the current world to detect drift. If audit logging fails, the service halts rather than running blind.
- SOC 2
- HIPAA
Sensitive data Card numbers and health IDs never reach your database raw.
Format-preserving tokenization at the application layer. The agent works with tokens. Your joins still work because the token shape is stable. PCI DSS scope is reduced via tokenization across all tiers. GDPR-covered data can be tokenized in the same pass.
- PCI DSS
- GDPR
Revocation End the session, end the access — atomically.
One call invalidates the token. Database users, certificates, storage tokens — everything the agent touched is revoked in the same operation. The operation is atomic: either everything revokes or the call fails and is retried. The audit log records the cascade with a timestamp.
- SOC 2
- NIS2
- GDPREU data protection
- SOC 2Type II
- ISO 270012022
- HIPAAUS health
- PCI DSSv4.0
- OWASPTop 10
- NIS2EU cyber
- EU AI Act
Security questions we get asked
If yours isn’t here, email security@launch.ist and we’ll add it.
Will the agent see my secrets?
Not the raw ones. Agents fetch ephemeral credentials at session start; those credentials work for minutes, are scoped to one task, and are revoked when the session ends. Long-lived keys never leave the secrets engine. The trail records when credentials were issued, to which session, and when they expired.
Where is data encrypted, and who holds the keys?
Sensitive fields are encrypted at the application layer with per-entity keys. Keys live in a managed secrets engine (OpenBao); your application code never handles them directly. Enterprise accounts can bring their own KMS. The key hierarchy is: per-entity data key → tenant master key → platform root key. Breaking one layer does not compromise another tenant.
What does a GDPR deletion look like?
We destroy the encryption key for that entity. The ciphertext stays in storage but becomes mathematically unrecoverable. Backups, replicas, and analytics caches are unaffected — there is nothing usable to scrub. The deletion is logged in the provenance trail with a timestamp and the identity of the requestor.
How do you prove a session left zero residual access?
Cascade revocation: ending a session triggers a single atomic operation that invalidates the session token, deletes database users created for the session, revokes certificates, and adds storage tokens to a revocation list. The audit log records the cascade. The trail is replayable — a compliance reviewer can confirm the state months after the fact.
Can you share your SOC 2 report?
Yes, under NDA. Email security@launch.ist and we’ll send the latest Type II report and the questionnaire response packet.
Do you handle PHI, cardholder data, or EU resident data?
PHI: available on Business and above; BAA available. PCI DSS scope is reduced via tokenization across all tiers. EU resident data: data residency in the EU on Business; default region on Dev/Shared, Starter, and Standard. If none of those tiers fit your compliance shape, email us — we'll tell you what we can and cannot do before you sign anything.
Need the security questionnaire pre-filled?
Email security@launch.ist with the form your buyer sent. We reply within one business day with the SOC 2 report, DPA, and answers in their template.