Security & Trust

What AgentTrail can see, and what it can't.

AgentTrail comes in two parts, and they handle your data very differently. Here is exactly what each one reads, keeps, and sends. Your agent vendor should not be the only auditor of your agent's behavior.

AgentTrail Guard

On your machine

The free, local guardrail you install with npm i -g @agenttrail/guard. No account, no sign-up, and no server it talks to.

  1. What it reads

    The command or file change your agent is about to make, so it can check it against the guardrail library before it runs. If you run scan, it also reads your agent's own session transcripts, on your machine, to build a local report.

  2. What it keeps

    Its settings, and a log of the calls that matched a guardrail (time, tool, decision, guardrail, command) in ~/.agenttrail/guard/. Secrets are scrubbed before anything is written. The log is capped at 1 MiB and 30 days, and you can clear it any time.

  3. What it sends

    Nothing, by default. The only network call anywhere in guard is crash reporting: off unless you turn it on, a scrubbed stack trace only, and it has nowhere to send until you configure an endpoint yourself.

Scrubbed, not sanitized. Scrubbing catches common secrets (API keys, tokens, connection strings, .env-style values), but a secret passed as a bare command-line argument can slip through. And guard decides whether a command runs; it never rewrites one.

Read every file guard writes, in its README

AgentTrail OS

Hosted · solo or team

The hosted product you and your team sign in to. It ingests telemetry about your agents' actions (traces, costs, policy decisions), built on the OpenTelemetry GenAI standard, so you can search it, catch repeats, and prove rules against it.

At a glance

  • TLS 1.2+ in transit, encrypted at rest
  • No cross-customer training without opt-in
  • Deleted within 30 days of a request
  • Every subprocessor named, with what it receives

How we map to the OWASP Top 10s

An item-by-item coverage matrix for the OWASP Top 10 for Agentic Applications and for LLM Applications, showing where AgentTrail stops the risk, where it adds visibility, and where it doesn't help.

View OWASP coverage

What we store, and what we don't

Trace metadata: agent actions, tool calls, timing, token counts, costs, policy evaluations. Trace payloads may include code context your agents operated on. We do not require access to your source repositories: the agenttrail hooks and OpenTelemetry exporter on your machine send session telemetry, not your codebase.

In the product these appear as Sessions (one sitting with an agent), Turns (one thing you asked for), and Spans (one action it took), the OpenTelemetry conversation, trace, and span, respectively.

How far back you can see follows your tier (7 days Free · 30 days Team · 90 days Business · custom on Enterprise, 365 days by default). Data older than that is hidden, not deleted: it stays stored until you ask us to delete it. Email security@agenttrail.sh and we delete your workspace's data within 30 days of the request.

Architecture

Frontend on Vercel; backend in AWS us-east-1, with Postgres for application data, ClickHouse for trace data, and S3 for exports and backups. All customers share this infrastructure; each workspace's data is kept separate at the API layer with org-scoped API keys. A dedicated single-tenant deployment is not available.

Encryption

TLS 1.2+ for the web app and API. Encrypted at rest: the Postgres database (RDS), the ClickHouse data volume, and S3.

Access control

Email/password with verification, plus Google and GitHub OAuth. Org-level RBAC. Scoped API keys for ingest. SSO (SAML) and SCIM provisioning are planned and not yet available.

Your data and our models

Pattern detection runs on your workspace's traces, for your workspace. We do not train cross-customer models on your traces without explicit opt-in. Cross-customer benchmarking is planned, would be opt-in, and is not available yet.

Compliance roadmap, stated plainly

We do not hold a SOC 2 report; a SOC 2 audit is planned but not started. HIPAA and a business associate agreement are not available. What is available today: this page, our subprocessor list, our Data Processing Addendum, and a CSV export of policy violations for workspace Admins.

We will not claim certifications we do not hold.

Subprocessors

AWS (hosting), Vercel (frontend), Stripe (payments), AWS SES (email), Upstash (Redis), Anthropic (AI classification and pattern review), Sentry (error monitoring), and WorkOS (sign-in). The full list, with the data each one receives, lives at /subprocessors.

Incidents & disclosure

Status page at status.agenttrail.sh. Security contact: security@agenttrail.sh. Coordinated disclosure is welcomed.

Have a security question?

Send it to our founding engineers. Coordinated disclosure is welcome at the same address.

Email security@agenttrail.shView subprocessors