Security
One policy where your stack isn't one vendor's.
Cortex enforces inside Cortex. Copilot Studio inside Copilot. Bedrock inside Bedrock. Conduct enforces across whatever mix your team runs — with a scope you can inspect.
Enforcement
Guard evaluates every action against your policy before it executes. Five enforcement surfaces catch every path an agent can take:
- CLIPost-tool-use hook on Claude Code, Cursor, Codex, Copilot. Local decisions, no round-trip.
- HTTPDrop-in base URL replacement in front of your model gateway. Two gates on every call: prompt before the model sees it, response before it returns.
- MCPWraps MCP tool invocations before they reach the server. Same policy engine, different transport.
- LENSEvery Lens chat LLM turn routes through the same policy engine. In-process, no round-trip.
Evidence
Every decision is a receipt. Hash-chained (SHA-256) so tampering is detectable, exportable by policy, and answerable to auditors.
See what a receipt contains →Rollout
Run Guard as SaaS, in a container, on Kubernetes, or fully isolated. Same policy engine, same audit trail, wherever your data must stay.
See rollout options →Threat model
We publish where Guard stops. Honest scope is a design requirement — and a differentiator, because heterogeneous coverage means we can't pretend to own every layer.
Coverage map
Actions routed through Guard (CLI hook, LLM proxy, MCP layer, Lens)
All five enforcement surfaces run the same policy engine — CLI hook, proxy prompt gate, proxy response gate, MCP, and Lens LLM turn. Refunds, network changes, secret reads — every action routed through Guard is inspected.
Audit trail integrity
SHA-256 hash chain on every decision. Altered entries break verification.
Pre-call prompt injection (before Guard sees the tool call)
Injection detection pack + pattern-based checks. ML-based detection is not implemented.
Model-layer attacks (adversarial inputs to the LLM itself)
Prompt-injection pack included. Semantic ML detection not implemented.
Cross-agent correlation (Operations context)
Guard evaluates each action in isolation today. Cross-agent context is the Operations gap — Design Partner Preview.
Actions that bypass all three enforcement surfaces
An agent that does not use the hook, proxy, or MCP layer is invisible to Guard.
Trust & compliance
What's certified, who touches your data, and how it's handled. Enterprise buyers paste this into their security review packet.
Compliance & attestations
Certifications in progress. Letter of intent and gap-analysis timeline available on request — email security@conductai.ai.
Data handling
- Stored: policy decisions, hash-chained audit entries, agent identities (cond_agt_*), credentials in encrypted vault.
- Not stored by default: LLM prompts, LLM responses, tool call payloads (metadata only).
- In transit: TLS 1.3 across every surface.
- At rest: provider-managed encryption (AES-256 across all sub-processors).
- DPA: available on request for Business and Enterprise.
Sub-processors
- Vercel — web hosting
- Render — API + worker hosting
- Clerk — authentication and SSO
- Cloud-managed PostgreSQL — primary data store
- Cloud-managed Redis — queue and cache
- Customer-chosen LLM providers (routed through Guard, not stored): Anthropic, OpenAI, Google, AWS Bedrock, Azure OpenAI, Ollama, self-hosted.
- Full sub-processor list available on request.
SSO & access
- Google, Microsoft, Okta — OIDC, shipped on Team and above.
- SAML — Enterprise, on request.
- Role-based access control (RBAC) — per-user scoped permissions.
- Session TTL — configurable per workspace.
Need something not listed here — audit retention window, specific sub-processor names, SOC2 timeline, DPA text? Email security@conductai.ai. Answers within one business day.
Responsible disclosure
Found a security issue? Email security@conductai.ai. We aim to acknowledge within 24 hours and coordinate on disclosure timing.