Security Model
How Glyphzero products are designed, what data we handle, and how to report vulnerabilities.
Runtime assurance
SURADAR verifies delegated authority and signed requests. Configured policy checks can require human approval before an agent action proceeds.
Data handling
SURADAR processes agent identities, delegation grants, action metadata, and policy decisions. Memory provenance deployments also process signed memory writes and retrieval attestations.
Stored evidence and retention depend on your deployment and configuration. Contact us to review the data flows for your use case.
Responsible disclosure
We take security vulnerabilities seriously. If you discover a vulnerability in any Glyphzero product, please report it responsibly:
- Email: [email protected]
- Response time: We will acknowledge your report within 48 hours
- Disclosure window: We ask for 90 days to remediate before public disclosure
- Scope: SURADAR and related APIs and infrastructure
Please do not use automated scanners against production infrastructure. We maintain a staging environment available for security researchers, contact us for access.
Penetration testing
Enterprise customers may conduct penetration tests against their own Glyphzero deployment. Please notify us at [email protected] before beginning testing so we can distinguish your activity from genuine threats.
Audit evidence
SURADAR evidence packages support review of delegation, policy decisions, and agent actions. Glyphzero does not certify compliance; your auditor does.
Questions about security?
Our security team responds to all inquiries within 48 hours.
[email protected] →