Most AI-vendor reviews are about what happens to your data on their side. Hedy ends that conversation: there is no our side. Below is the control set — each one lives in code, and your auditors can read it.
Hedy deploys as containers in your VPC via Docker Compose or Helm — or fully air-gapped with local models. There is no multi-tenant cloud, no shared database, no Hedy-operated backend.
The list is empty because there is no list. Your data is processed by your machines under your existing agreements. Model API calls go to providers you choose, with your keys — or to local models with no external calls at all.
Application services bind to loopback by default; only your reverse proxy is exposed. Images are version-pinned (semver, never latest).
Knowledge base, embeddings, conversation memory, audit logs and token metering live in your PostgreSQL. Backups are your scripts writing to your storage.
Credentials enter through deployment environment injection, full stop. The repository ships an example file; the agent is hard-ruled never to store credential values in memory, files or logs.
Nothing is collected by us, so nothing can be trained on. If you use external model APIs, your own provider agreement governs — and air-gapped mode removes even that.
Every API — including internal service-to-service — requires authentication. Console access is role-based (admin / approver / member).
Retrieval is filtered by the asker’s clearance tags before ranking. Filtered documents are not summarized, hinted at, or counted into answers.
External-facing employees are hard-capped to the public knowledge layer and stripped of internal data tools — enforced in code, verified in tests.
Agent data queries use a database-level read-only role — not a session flag that can be toggled.
Every sensitive action class carries a tier stored in the database: L0 auto, L1 requires human approval, L2 forbidden. Prompts cannot change tiers.
Repository writes require explicitly listed projects. Code ships as draft PRs; merging is reserved for humans.
Scheduled jobs must name their destination. "Send to whoever asked last" is structurally impossible.
Every action is recorded with actor, object and reasoning. The schema has no update or delete path — not for the agent, not for admins.
Write-operation statistics aggregate what the employee did and where, so "what has it been doing?" is a dashboard, not an investigation.
Release gates include adversarial probes: salary questions from unprivileged askers, credential requests, injection-style prompts. A leak is a failed release, not a footnote.
Knowledge answers must quote their source passage verbatim; a machine check verifies the quote exists. Judges that hallucinate get overruled.
Security-relevant calls never fall back to weaker models under quota pressure — they refuse instead. Weaker models are easier to inject.
Fetched web pages, emails and documents are data, never instructions. The runtime treats embedded commands as content to report, not orders to follow.
Licences are Ed25519-signed and validate offline. No licence server phone-home.
Found something? security@hedy.one. We respond fast and credit researchers. We are a young product: we publish controls instead of badges, and your auditors can read the code.