Security & trust

Built for the workloads your auditor cares about.

Single-tenant by default. Self-hostable when you need to keep data on your own ground. Every action — agent, human, or workflow — leaves a signed audit trail.

Posture

Four pillars. Boring on purpose.

01 — Isolation

One tenant per stack. No noisy neighbors.

Every customer gets a dedicated VPC, dedicated database, dedicated compute. There is no shared multi-tenant runtime. A bug in another tenant's workflow can't reach your data because their workflow doesn't run on your servers.

  • Dedicated AWS account or VPC per tenant
  • Aurora Postgres cluster per tenant — no cross-tenant queries possible
  • KMS keys per tenant, customer-managed available
02 — Secrets

Credentials never touch workflow definitions.

Connector credentials live in AWS Secrets Manager, referenced by ARN. Workflow JSON only contains references — never values. Engineers building workflows don't see — and can't accidentally commit — production secrets.

  • Per-environment secret scoping (dev/stage/prod)
  • Automatic rotation supported for AWS-native services
  • Secret access audited at the policy level — every read is logged
03 — Audit

Every step. Every input. Every output.

Workflow runs are immutable. We record the workflow version, every step's inputs and outputs, who triggered it, and how long each step took. Run logs are retained for 7 years (configurable up to 10) and exportable to your SIEM via a streaming endpoint.

  • Workflow definitions are versioned — you can replay any historical run on its original code
  • PII fields can be redacted at write-time using a per-field policy
  • Streaming exports to Splunk, Datadog, Elastic, or any S3 bucket
04 — Identity

Your IdP. Your roles. Your groups.

SSO via SAML or OIDC out of the box — Okta, Entra, Auth0, Ping, Google Workspace. SCIM provisioning syncs groups; your groups become Nexus role bindings. Service accounts get short-lived JWTs scoped to specific workflows.

  • SAML 2.0 + OIDC + SCIM 2.0
  • Granular RBAC: per-workflow, per-environment, per-connector
  • MFA enforced at IdP layer; we never own your credentials
Where your data goes

A simple shape. No surprises.

The runtime envelope is small on purpose. Workflow data only ever passes through systems you've explicitly authorized.

[trigger] webhook · schedule · MCP tool call · form submission
   [Nexus engine]  // runs in your single-tenant VPC
     [connector]  // HTTP/MCP call to your system of record
     [Postgres]  // run state, not customer data by default
     [CloudWatch]  // structured logs, redacted
     [your SIEM]  // optional streaming export

// What never happens:
[never] data sent to third-party LLM unless you wire it explicitly
[never] shared compute or shared database with another tenant
[never] Santeon employees access your runtime without break-glass + your approval
Compliance

Where we are. Where we're going.

We're transparent about which certifications are signed and which are in flight. If you need an artifact we don't have yet, talk to us — most enterprise gaps are bridged with controls evidence and a vendor questionnaire.

SOC 2 Type II
Audited 2025
ISO 27001
Certified
HIPAA
BAA available
GDPR
DPA available
FedRAMP Mod.
In progress · Q3 2026
PCI DSS
Self-hosted only
CCPA
Compliant
CSA STAR
Level 1
Controls

Cloud vs. self-hosted, side by side.

Both deployment models share the same engine and the same audit semantics. The differences are about where the runtime lives and who runs the underlying AWS account.

Topic
Nexus Cloud
Self-hosted
Hosting
Santeon-managed AWS account, single-tenant VPC
Your AWS account, your VPC, your IAM
Data residency
us-east-1, us-west-2, eu-west-1, ap-southeast-2
Any region you operate in
Encryption at rest
AES-256 · AWS KMS, CMK optional
AES-256 · your KMS, your keys
Encryption in transit
TLS 1.3 — internal & external
TLS 1.3 — internal & external
Network isolation
Private subnets · VPC endpoints for AWS services
Your VPC topology · PrivateLink supported
Authentication
Cognito + your IdP (SAML/OIDC)
Cognito or your existing Cognito pool · same IdP
Backups
Aurora continuous backup · 35-day PITR
Configurable · default 35-day PITR
SLA
99.9% uptime · enterprise tier 99.95%
Bound to your AWS account SLAs
Patching
Santeon-managed · weekly maintenance window
Helm upgrade or Terraform apply on your schedule
Penetration testing
Annual third-party · report under NDA
Run your own at any cadence
Disclosure

Found a vulnerability? Tell us.

We run a private bug bounty through HackerOne. If you've discovered a vulnerability, please don't post it publicly — email security@santeon.ai with reproduction steps. We acknowledge within one business day, scope within five, and disclose with credit unless you'd rather stay anonymous.

Our PGP key is available at santeon.ai/.well-known/pgp.asc.

Trust artifacts

SOC 2, DPA, BAA, pen-test reports.

Procurement-ready packets are available under NDA. Most are e-signed and back the same week.