Trust & security
Secure by default. Never trained on your data.
Don't trust the agent. Control the action. OneBee constrains what each agent can reach, keeps a person in the decisions you choose, and records what actually ran. Our founders spent their careers defending critical systems. Agents get the same discipline.
SOC 2 Type I reportType II observation period underwayOpen the trust center What goes wrong, and what stops it
Eight checkpoints on the path from request to record.
An AI agent reads things you didn't write and acts inside apps your business runs on. Follow an example from the moment it arrives to the moment it's logged, and see what OneBee checks along the way. Pick any checkpoint to pause on it.
We never train on your data
By contractFull stop. Your data is used only to run the agents you've asked for, never to train models, ours or anyone else's. It's written into every contract, and it's core to our DNA.
The agent reads a signed lease and updates the matching deal in HubSpot.
Is it allowed to use this app?
In this example: Yes · it's on the list
The agent uses a real, connected app to do something it shouldn't.
Each agent can use only the apps you switch on for it. Anything else is refused, and you can switch an agent off in one click.
Architecture
One home. A short, named supply chain.
No mystery infrastructure. Your agents and data live in Google Cloud; everything else is a small set of vetted providers, each doing one job.
Google Cloud Platform
The platform, your agents and your stored data run in Google Cloud. Model calls go to the named providers below, none of which train on your data.
Vetted subprocessors: none train on your data
Microsoft AzureFrontier models; no training on your data
CloudflareEdge network, DDoS protection, WAF & classification models; no training on your data
AnthropicFrontier models; no training on your data
OpenAIFrontier models; no training on your data
xAIFrontier models; no training on your data
BasetenOpen-weight model inference
Fireworks AIOpen-weight model inference
Brave SearchIndependent web search; no training on queries
ResendTransactional email deliveryIsolation by design. Each agent reaches a provider only through its scoped allow-list, and only for the task at hand. No provider gets standing access to your environment, your credentials, or your data.
Encrypted in transit and at rest. TLS 1.2 or later in transit and AES-256 at rest. The credentials agents use to reach your systems are encrypted again with AES-256-GCM.
Your data
What your data powers, and what it never will.
What your data powers
- Running the specific agents and tasks you've approved
- Tuning your agents for your workflows
- Monitoring for drift, errors, and anomalies
- The audit log you can inspect and export
What we’ll never do
- Train models, ours or anyone's, on your data
- Sell, rent, or share your data with advertisers
- Let subprocessors train on or learn from your data
- Give agents standing access beyond their allow-list
Shared responsibility
What we run. What you own. What's out of scope.
An agent platform is a shared system. Here is the split, in the same words as our contract, so your security team can read it before the contract and not after.
| Area | We run | You own |
|---|---|---|
| Access | Scoped permissions, allow-lists, tenant isolation, encrypted credentials, logs, one-click revoke. | Which systems and scopes to authorize. MFA on your identity accounts. Offboarding people and connectors. |
| Actions | Approval gates, budgets, limits, durable runs, the action record. | What the agent is told to do, and which actions wait for a person. |
| Data | No-training terms, encryption, the DPA, retention and deletion. | A lawful basis for connected data. What's appropriate to send to a model. |
| Incidents | Monitoring, incident response, notice within 72 hours of confirmation. | Reviewing run records. Reporting a compromised credential. A security contact we can reach. |
| Consequential use | Approval controls, and an Acceptable Use Policy that requires qualified review for decisions with legal or similar effect. | Never making the agent the sole decision-maker for those. Sector-specific legal review where it applies. |
Access
We run
Scoped permissions, allow-lists, tenant isolation, encrypted credentials, logs, one-click revoke.
You own
Which systems and scopes to authorize. MFA on your identity accounts. Offboarding people and connectors.
Actions
We run
Approval gates, budgets, limits, durable runs, the action record.
You own
What the agent is told to do, and which actions wait for a person.
Data
We run
No-training terms, encryption, the DPA, retention and deletion.
You own
A lawful basis for connected data. What's appropriate to send to a model.
Incidents
We run
Monitoring, incident response, notice within 72 hours of confirmation.
You own
Reviewing run records. Reporting a compromised credential. A security contact we can reach.
Consequential use
We run
Approval controls, and an Acceptable Use Policy that requires qualified review for decisions with legal or similar effect.
You own
Never making the agent the sole decision-maker for those. Sector-specific legal review where it applies.
Out of scope
Not designed for Restricted Data: Social Security and taxpayer numbers, payment cards, financial account numbers and credentials, account passwords, health records, biometrics, government IDs, data about children under 16, criminal records, GDPR special categories. We are not a HIPAA business associate and the platform is not designed for PCI cardholder data. If your workflow touches any of these, tell us before you build. It takes a written agreement, not a checkbox. Section 13 of the DPA
Evaluating us? Here's what we'll hand over.
We've sat on your side of the vendor review. Ask and we'll provide:
Contact our team Request documents- The SOC 2 Type I report, with scope and exceptions
- Completed security questionnaires
- Architecture and data-flow diagrams
- The control map: threats, controls and evidence, mapped to MITRE, OWASP, NIST and SOC 2
- The role, tool, approval and revoke design for your workflow
- A redacted end-to-end action trace and audit-log export
- Our evaluation criteria and incident process
- Our DPA, incorporated by reference
- Infrastructure provider certifications
- Direct line to our security team