Executive Summary

1. Security Architecture Principles

• •Defense in depth: No single control protects any asset. Every layer - network, identity, data, application, AI - has independent security controls that assume the adjacent layer may be compromised.
• •Zero trust: Every request is authenticated, authorized, and encrypted regardless of network location. Internal services use mTLS. There is no trusted network perimeter.
• •Least privilege: Users, agents, and services receive the minimum permissions required for their function. Permissions are scoped per tenant, per workspace, and per operation.
• •Tenant isolation: Customer data is logically isolated at the storage, compute, and network layers. Cross-tenant data access is architecturally impossible without breaking multiple independent controls.
• •Fail secure: When a security control fails, the system denies access by default. Circuit breakers halt operations rather than allowing degraded-security operation.

2. Infrastructure Security

3. Identity & Access Management

4. Data Protection

5. AI Safety & Agent Security

• •No training on customer data: WorkSwarm contractually prohibits the use of customer data for model training. All LLM provider DPAs include explicit no-training clauses. Prompts are redacted of PII before leaving the platform.
• •Output validation: Every LLM response passes through a validation pipeline: schema validation (correct format), allowlist checking (permitted actions only), content filtering (no harmful content), and PII detection (no customer data leakage).
• •Tool gating: AI agents can invoke tools (APIs, databases, external services). High-blast-radius tool calls - those that modify data, send communications, or commit funds - require explicit human gate approval before execution.
• •Token limits and circuit breakers: Per-call token caps prevent cost runaway. Per-agent daily limits prevent recursive loops. Circuit breakers halt execution after configurable failure thresholds.
• •Agent audit trail: Every agent action is logged with full context: input prompt, output response, tools invoked, gate decisions, latency, token usage, and cost. Logs are immutable and exportable to customer SIEM.
• •Model provider isolation: WorkSwarm supports multiple LLM providers (Anthropic Claude, Google Gemini). Customers can restrict to specific providers based on data sovereignty or contractual requirements.
• •Bias and safety evaluation: Quarterly evaluations using industry-standard benchmarks. Results published in the AI Safety Evaluation Summary (available Q4 2026).

6. Secure Software Development Lifecycle

• •Threat modeling: Conducted for every new feature using STRIDE methodology. Updated quarterly for existing features.
• •Code review: All code changes require peer review with security-focused checklist. Automated SAST scanning on every pull request.
• •Dependency management: Software Bill of Materials (SBOM) generated for every release. Automated vulnerability scanning of all dependencies. Critical CVEs patched within 24 hours.
• •DAST and penetration testing: Automated DAST scanning in staging environments. Annual external penetration test by an independent firm. Quarterly internal red team exercises.
• •Secure deployment: Immutable container images, signed and verified before deployment. Infrastructure as Code with security policy enforcement. Canary deployments with automatic rollback on anomaly detection.
• •Incident response: Documented incident response plan tested quarterly. Severity classification (P0-P4) with defined SLAs. Post-mortem published within 14 days of resolution.

7. Vendor & Sub-processor Management

• •Due diligence: Security assessment before onboarding. SOC 2 Type II or equivalent required. Annual reassessment.
• •Contractual controls: Data Processing Agreements (DPAs) with all sub-processors. Audit rights retained. Sub-processing restrictions enforced.
• •Customer notification: 30-day advance notice before any new sub-processor goes live. Customers can object; unresolved objections allow penalty-free termination.
• •Ongoing monitoring: Continuous monitoring of sub-processor security posture. Quarterly review of access permissions. Annual DPA renewal and compliance verification.

8. Compliance & Certification Status

9. Audit Logging & Evidence

• •Immutable logs: Every event is written to an append-only log store. Events cannot be modified or deleted by any user, including WorkSwarm administrators.
• •Hash-chaining: Each log entry includes a cryptographic hash of the previous entry, creating a tamper-evident chain. Any modification breaks the chain and is detectable.
• •HSM signatures: Log batches are signed using Hardware Security Module-backed keys, providing non-repudiation.
• •Legal admissibility: Logs are exportable with Indian Evidence Act Section 65B certificates for Indian courts and US Federal Rules of Evidence 901/902(13) self-authentication for US courts.
• •SIEM integration: Real-time log streaming to customer SIEM platforms: Splunk, Microsoft Sentinel, Sumo Logic, Elastic, Datadog. Standard CEF and OCSF formats supported.
• •Retention: 7-year default retention for audit logs. Customer-configurable. Logs stored in immutable S3 buckets with Object Lock.

10. Contact