Security
Wrasse runs an autonomous agent that holds your credentials and acts on your behalf. That is a serious thing to be trusted with, and the architecture is built around assuming the agent itself can be compromised — then making sure that is survivable.
The short version: your agent runs on its own machine, every tool call is checked before it runs, we never train on your data, and closing your account erases your data 30 days later, apart from what the Privacy Policy lists as kept or not yet erased.
This page describes what we actually do. Where something is a target rather than a fact, it says so; there is a table of exactly that further down. If you are running a security review and need more than this, write to security@wrasse.ai and ask — we will send our review materials, and tell you where our data processing agreement stands.
The design assumption
An AI agent is an untrusted process by construction: it takes instructions from the outside world, and it decides what to do next. So Wrasse does not try to make the agent trustworthy. It puts the boundary outside the agent — the isolation is around the container, the policy check happens before each tool runs, and the model-provider keys live on the other side of the fence entirely. Two parts of that boundary are still being built: enforcing network egress at the container, and running the agent and the policy check under separate privileges.
Controls
One container per user
Your agent runs in its own virtual machine, with its own volume — not a shared process, not a shared filesystem. It never shares a virtual machine with another user's agent.
Every tool call is checked before it happens, not after
A policy sidecar sits in front of the agent's tools. Every single tool call is evaluated against your policy before it executes, and recorded either way. That ordering is the point: a log that tells you what already happened is a receipt, and a check that runs first is a control.
Model-provider keys never enter your container
The container is treated as untrusted, and the credential model follows from that. It holds a token minted for that one container, which resolves to exactly one user, so a compromised container cannot act for anyone else. Model-provider keys are held only by the control plane, which makes the call on the agent's behalf — the container never learns another provider exists. This is enforced by an automated test that fails the build if any variable outside a fixed allowlist is injected into a container.
Secrets are encrypted
Third-party tokens, integration keys and platform secrets are encrypted with AES-256-GCM, with a key version stored alongside new records. The console shows a fingerprint rather than a value — for credentials that a provider only ever shows once, there is no reveal path at all.
The audit trail is the product, not a feature
Every tool call — including the emails and other messages sent through your connected accounts — is appended to an audit log you can read, filter and export. A record holds what ran, when, the policy decision and digests of its inputs and outputs, not the raw content (the network log also keeps the address each web request went to, which for a plain-HTTP request includes its path and query); when your policy holds an action for you, the request keeps what it asks you (the recipient, subject and draft) so you can decide. Our retention period for records is 90 days. The job that deletes older records is not yet automatic everywhere the log is stored, so some may be held longer until it is.
Least privilege for our own people, too
Operator access to the platform console is permission-based rather than role-based: a person is granted the specific capabilities they need, every privileged action is attributed and recorded in our platform audit log, and opening a tenant's account as them takes a time-limited support session with a stated reason. There is no shared administrator login.
Data protection
- In transit — the dashboard and our API are reached over HTTPS, as are the integrations we connect for you. Nothing yet forces every request an agent's skill makes to use HTTPS.
- At rest — third-party tokens, integration keys and platform secrets are encrypted with AES-256-GCM, as described above.
- Residency — your agent's machine runs in US East (Virginia) or London (United Kingdom) and is pinned to that region. It does not move on its own. The account data the control plane holds is not pinned to your region yet.
- Segmentation — each user's agent runs in its own container, with its own volume.
- Deletion — closing an account stops your agent at once and erases your data 30 days later, apart from what the Privacy Policy lists as kept or not yet erased.
What we don't do
- We do not train models on your conversations, your documents, or your agent's activity.
- We do not sell personal data, and we do not share it for advertising.
- We do not aggregate one user's content with another's for any purpose.
- We do not run third-party analytics or advertising scripts on this website. The one third-party script is Cloudflare Turnstile, on the free tools, guarding the listing generator and emailed results; see the Privacy Policy.
- We do not send marketing messages to a phone number you connect.
Where we are on certifications
We are a small team working toward certifications methodically, and we would rather tell you the truth about the timeline than imply an audit we have not had. Wrasse is not currently SOC 2 certified and has not yet completed an independent penetration test. Here is the plan, and where each item stands:
Email security@wrasse.ai for current status, our security review materials, or where our data processing agreement stands. Our subprocessors are listed at wrasse.ai/subprocessors.
Reporting a vulnerability
Send security issues to security@wrasse.ai. Please include reproduction steps, impact, and any proof-of-concept code. We acknowledge within 24 hours and triage within 72 hours, and we credit researchers in our public disclosure log unless you would rather stay anonymous. The bug bounty opens publicly in January 2027; we pay privately now.
Please do not test against accounts that are not yours, exfiltrate any data, or run automated scanning that affects availability for other users. Everything else is on the table, and we will not pursue researchers who act in good faith within those limits.
Incidents
If an incident affects your data, we will tell you — what happened, what was reached, what we did, and what you should do — without waiting for the investigation to close. Where the law sets a notification deadline, we meet it; where it does not, we still tell you.