Security at Actori
Actori is the control plane that governs what AI agents can do — we hold it to the standard we sell.
Data protection
In transit
At rest
Your agents don’t need to hold the keys.
Actori holds every downstream credential — your AWS keys, Snowflake passwords, GitHub/Slack tokens, SSH keys — and makes the call itself. Your agents get results, not credentials.
- ✓Connector credentials are AES-256 encrypted at rest.
Identity & access
- ✓Every agent has its own identity — a per-agent signed token and least-privilege grants. Revocable.
- ✓Admin sessions use signed tokens with pinned signing algorithms.
- ✓SSO for admin login: OIDC (Okta, Microsoft Entra ID, Google Workspace, or any OIDC provider), configurable per organisation.
- ✓Role-based and attribute-based access control, enforced on every action before it dispatches.
Deployment & isolation
Shared infrastructure in Actori’s cloud (US region). Fastest onboarding; tenant isolation is fail-closed.
For enterprises that require it, Actori runs your instance in an isolated cloud account — same platform, no shared infrastructure.
Auditability
- ✓Actions are recorded and the records are written server-side at the gate, not by the agent — an agent can’t fabricate or erase its own trail.
- ✓Every record carries its decision basis — which grant matched, which policy rules ran and what they returned, as they stood at that moment — so an auditor never has to ask what the rules were back then.
Data handling & privacy
- ✓Actori is a governance layer, not a model provider — it does not train any model on your data.
- ✓Optional AI-assisted features: when you enable them, requests are sent to the LLM provider you select (Anthropic, OpenAI, Google, or Mistral) using your own API key. These features are off by default.
- ✓The following are configured by you, with your own credentials, and are not Actori subprocessors: your connectors, your notification channels (email, Slack, Telegram, WhatsApp or a webhook), and — if enabled — the LLM provider above.
- ✓Where your data lives: Actori’s cloud (US region).
- ✓Subprocessors (parties that may process customer data on our behalf):
- –Amazon Web Services (AWS) — hosting, the database and its backups, and outbound email (us-east-1).
- –Google — sign-in, if you sign in with Google.
- –GitHub — sign-in, if you sign in with GitHub.
Audit log retention. Audit records and agent activity are kept for as long as the account exists — an audit trail with holes in it is not an audit trail. Server logs are kept for 30 days and database backups for 7 days.
Data deletion. When you close your account we delete its data within 30 days of the request, and the copies in backups expire 7 days after that. We may retain what the law or a contract requires. The full schedule is in the Privacy Policy.
Security & your review
Actori is early-stage and does not hold formal certifications (SOC 2 / ISO 27001) yet. Here’s how we protect your data and support your security team:
- ✓We’ll complete your security questionnaire and walk your team through our architecture.
- ✓Report issues: security@aonuva.com
Reliability
Availability. Production runs across two availability zones: the database keeps a standby replica in the second zone, and the application tier scales across both.
We don’t publish a contractual uptime figure at this stage; a formal SLA is available as part of an Enterprise agreement.
Have a security question, questionnaire, or issue to report?
security@aonuva.com