Agent YurtTRUST CENTER · VERSION 2026-11-10
Clear about
the boundary.
How Agent Yurt protects portable agent state, where service operations can access it, and what remains a beta limitation.
What is true today
These claims describe the current product boundary. They do not promise a certification, dedicated hardware or a guarantee that a snapshot is complete.
| Control | Status | What it means |
|---|---|---|
| Logical tenant isolation | Current | Every account-owned record is authorized against its tenant. Personal plans run in a shared Agent Yurt workload account; each personal space has a separate authorization boundary. |
| Encryption at rest | Current | Continuity payloads use authenticated encryption and integrity checks with service-managed key material. Authorized service operations can decrypt content when the requested service requires it. |
| Scoped agent access | Current | Agent credentials are scoped, shown once, stored as hashes and revocable. A credential does not create human consent or reconnect external providers. |
| Independent assurance | Not claimed | Agent Yurt does not currently claim SOC 2, ISO 27001, HIPAA certification, a penetration-test attestation or an enterprise availability SLA. |
Provider register
Provider placement is an internal implementation detail for Personal plans, but the providers that can receive service data are disclosed here. “Planned” means the integration is not an active Personal Free entitlement.
| Provider | Purpose | Data | Status / location |
|---|---|---|---|
| Cloudflare | Worker, private R2 object storage, D1 database, TLS and operational security | Account data, stored content and network metadata | Global infrastructure; no customer-selected residency |
| Resend | Transactional verification and recovery email | Recipient and one-use account link | See Resend privacy and processing terms |
| Stripe | Planned billing | Billing identity and payment tokens when enabled | Planned; Agent Yurt does not store full card numbers |
| GitHub | Public source and private security reports | Repository metadata and reports you choose to submit | United States |
We update this register when a new provider is approved for customer data. The Privacy Notice explains purposes, retention and rights.
Report a vulnerability privately
Use a private GitHub security advisory for the Agent Yurt repository or email security@solvopus.com. Include a concise description, affected route or version and non-sensitive reproduction steps.
Do not include tokens, passwords, customer snapshots or other private state. We will acknowledge a report when the channel is available, coordinate a fix where practicable and publish only information that is safe to share. There is no security-response SLA or blanket safe-harbor promise during beta.
Known limitations
- Service-managed encryption is not zero-knowledge or end-to-end encryption.
- Personal Free is manual continuity with best-effort recovery; keep an independent copy.
- Recovery does not restore credentials, permissions, schedules or external connectors.
- Personal plans use logical isolation in a shared workload account. Each personal space has its own authorization boundary.
- No SOC 2, ISO, HIPAA or enterprise SLA claim is made until evidence and review support it.
Last reviewed October 27, 2026 · Terms · Privacy · Acceptable use