Company isolation starts in the database.
Every company-owned record carries its account boundary. Database row policies enforce that boundary, and automated isolation tests try to cross it before every release.
Security · the implemented story
Useful autonomy needs hard boundaries.
Cortex is designed so a polished answer cannot quietly become an unauthorized action. Isolation, evidence, approvals, and audit state are enforced below the model layer.
Certification status
No badge theater.
Cortex is not represented as SOC 2 certified. The product has a SOC 2-ready control posture in its architecture, while formal control mapping and audit-readiness work remain in progress.
Controls you can point to
Security claims mapped to working mechanics.
These are implementation statements, not certification claims. The repository’s tests are the current evidence surface.
Provider tokens stay with the OAuth broker.
Cortex stores connection references and the minimum documented permissions. A dedicated OAuth broker handles syncing, so provider access tokens are not stored in Cortex application tables.
Every provider write uses one gateway.
Automated checks reject code that bypasses the action gateway. Before anything changes outside Cortex, the gateway validates the company, active work, permission level, approval, provider access, duplicate protection, and cost cap.
Autonomy is explicit and reversible.
Agents begin draft-only. A member can require per-action approval or explicitly grant bounded autonomy. Pausing or downgrading an agent does not erase its prior audit history.
Audit history resists quiet rewriting.
Mutations write actor, action, target, correlation, and bounded metadata to an append-only audit table. Database triggers reject update and delete attempts against that history.
External text is evidence, not instruction.
Prompt-injection cases run in CI against messages and documents that attempt to override policy or call writes. Retrieved content remains delimited data, and no model can bypass the gateway.
The public demo has independent write barriers.
Its UI disables action controls, every account-change route rejects the demo context before reading a request, and the final gateway checks a durable demo flag before creating any action state.
Autonomy ladder
The same agent can earn more room without changing the safety path.
Draft only
Prepare the exact artifact. Never perform a final send, post, CRM update, or document mutation; a registry-declared provider draft may save the review artifact itself.
Approval required
Show the exact preview and wait for a current decision from this company.
Autonomous
Act only inside configured tool, scope, cost, and runtime bounds.
Merge-blocking tests
The attack path stays in CI.
- Attempts to read or change records across company boundaries
- Prompt injection embedded in provider records
- Direct production imports that bypass the write gateway
- Anonymous and demo attempts against every HTTP mutation route
- Unsigned identity, payment, and connection callbacks
- Ledger settlement, dispute, billing, and reversal edge cases
Inspect before you connect