Security
The isolation model, in detail.
This page names mechanisms rather than adjectives, and states what is missing. If a control matters to your review and it is not here, assume we do not have it and ask — we will answer the same way in writing.
Data boundary
What holds your data apart
Tenancy is enforced where it cannot be forgotten — in the database and in the key layout — rather than in application code that has to remember.
| What holds | How it is enforced | Where |
|---|---|---|
| Per-organization isolation in the database | Row-level security is enabled and FORCEd on every product table, with an organization policy per table. The API connects as a restricted role, not the table owner, and sets the organization for the request — so a query missing its filter returns zero rows. | postgres · withOrg |
| Per-organization isolation in object storage | Blobs carry no row-level security, so tenancy lives in the key: a request-scoped handle can only address keys under its own organization prefix. | storage(orgId) |
| Repository access is a copy, not a connection | An agent operates on a copy of the repository inside a disposable sandbox. Nothing writes to your default branch; output arrives as a branch and a pull request. | sandbox provider |
| Secrets are write-only and decrypt at egress | Values are encrypted with the organization bound in as additional authenticated data, are never readable back through the interface or the API, and are decrypted only when injected into a run. Use is audited and matches are redacted from run output. | vault |
| Capability enforcement at execution time | An agent’s tool grants are checked when a tool runs, not merely reflected in what the interface offers. | capability gate |
| Append-only audit trail | UPDATE and DELETE are revoked on the audit table at the database level, so the application cannot rewrite history even if it is compromised. | audit_event |
| Permissions mirrored on both sides | Roles and per-surface permission statements are defined once and imported by the API and the clients, so what the interface hides is also what the server refuses. | shared access control |
Gaps
What we don’t have
- No SOC 2, ISO 27001 or HIPAA certification, and no audit under way. We will not use "SOC 2 ready" or "aligned with" to imply otherwise.
- No self-hosted, single-tenant, VPC or air-gapped deployment option today.
- No customer-managed encryption keys.
- No formal penetration test published. When one is done, the report summary goes here with a date.
- No published data-processing addendum or subprocessor list yet. Ask and we will send what exists today, including the gaps.
- Versioned preview deployments exist for builder sessions but are not yet on every run type.
Questions
What security reviews ask
- Is our code used to train models?
- We do not train models on your code. The complete answer has a second half we will not paper over: inference runs through third-party model providers, so their terms also apply. We will name the exact providers in your configuration and share their data-handling terms on request. If that is a gating concern for your review, raise it early — it determines which providers we can run you on.
- What happens to a sandbox after a run?
- It is destroyed. Where a run is resumed, the environment is retained deliberately and for a bounded period so the work survives a restart; the retention window is part of what we will walk your team through.
- Who at Delatura can see our repositories?
- Access to production systems is limited to the engineers who operate them, and administrative actions land in the same audit trail as everything else. We are a small pre-release team and we would rather tell you exactly what that means than describe a control we have not built.
- How do you handle prompt injection through intake?
- It is a real attack on this shape of product: a crafted error report or ticket that a coding agent then acts on. The structural answer is that agents run in an isolated copy with granted capabilities and cannot reach production, and that output passes verification before a human is asked to approve it. That bounds the damage; it does not eliminate the attack, and we will not claim it does.
Talk to usBring your security questionnaire — we would rather answer it early than late.