Built so one workspace cannot see another
Your company's context is the most sensitive thing you will put into any tool. These are the mechanisms that hold, and where each one is enforced.
- One workspace cannot read another
- Isolation is enforced in the database, not in application code that could forget a WHERE clause. Every scoped read and write runs through one narrow database role under Postgres row-level security, and there is no code path that widens it or steps around it.
- No credential ever reaches an agent
- Agent work runs in a sandbox that is handed an identifier and nothing else. Provider keys, connector tokens and database credentials live on our side of that boundary and are never written into a sandbox environment, so a prompt that talks an agent into revealing its secrets has none to reveal.
- Content an agent reads is data, never instructions
- A document in your vault, a page fetched from the web and a message from a connected tool are all treated as untrusted input. None of it renders on the same origin as your session and none of it carries your credentials anywhere.
- Every credit is an auditable row
- The usage ledger is append-only. A debit is idempotent, a run that gets declined rolls back its own charge, and the workspace can always answer what was spent, by whom, on which run, on which day.
- Your data is not training data
- Nothing in your workspace is used to train a model, ours or a provider's. Work is sent to a model provider to be answered and that is where it ends.
- Approvals where you want them
- An agent can be required to stop and ask a person before it acts. The run waits, the request is attributed, and nothing goes out while it waits.
Certifications
Consul does not hold SOC 2 or ISO 27001 today, and this page will not pretend otherwise. If a formal report is what your procurement process needs, tell us what it has to cover and we will tell you honestly where we are.
Reporting a vulnerability
If you have found something, we want it before anyone else does. Send the details through the contact form and mark it as a security report. We will confirm receipt and keep you posted on the fix.