Security
Security at Pramiti Labs
We build the control plane other teams use to keep AI agents safe, so our own bar is simple: assume breach, enforce deterministically, and produce evidence a third party can check. Here is what that means in practice.
Enforcement lives outside the model
Every agent action is validated by a deterministic policy gate before execution — never by asking the model to behave. A prompt-injected agent produces the same DENY as an honest one.
Fail-closed by design
If policy cannot be evaluated, the action does not execute. Workspace kill switch, per-agent budgets, and runaway-loop auto-suspend are built in; the break-glass override is explicit, scoped, and signed.
Cryptographic evidence
Every decision is recorded as an Ed25519-signed, hash-chained, append-only attestation, anchorable to write-once storage (S3 Object Lock) and exportable to your SIEM in OCSF format (Splunk HEC, Microsoft Sentinel).
Independently verifiable
Attestation exports follow the emerging MCP signed-execution record standard (SEP-2828) and can be checked offline by a standalone, vendor-neutral verifier CLI — your auditor does not have to trust us.
Data minimization in the read plane
Database connections are read-only. Row-level-security predicates are injected into every query, and PII is masked before any LLM call sees the data.
Deployment options for regulated environments
Self-hosted deployment is available. The knowledge model your team approves belongs to you and exports to open formats.
Compliance reporting
The platform generates scored, evidence-backed reports against SOC 2, DORA, ISO 42001, NIST AI RMF, and the EU AI Act — built from the attestation record itself. (These are report-generation capabilities, not certifications of Pramiti Labs.)
Reporting a vulnerability
If you believe you have found a security issue in our platform, packages, or websites, please email us. We read every report and will respond as quickly as we can. Please do not test against systems or data you do not own.
[email protected]