Every control your reviewers ask about maps to a mechanism in the platform, not a promise on a slide.
| What your reviewers require | The mechanism |
|---|---|
| Data never leaves your environment | Self-host or air-gap: your VPC or fully offline, on your data. |
| No data exfiltration | Egress lock (Enterprise mode): the agent's outbound paths, model calls and HTTP tools alike, are blocked at the gate, so a prompt-injected agent can't exfiltrate through them. Pair with a network egress firewall to also cover raw-shell paths. |
| Least privilege, per action | Capability tokens (attenuate-only): an agent narrows its rights, never widens. |
| Separation of duties | Dual control: the person who initiates an action can never be the one who approves it. N-of-M sign-off, enforced. |
| Bounded blast radius | Sandbox, network-off by default · hard budget caps on tokens, dollars, wall-clock, and tools. |
| A human stays in control | Policy on every action: allow, deny, or require a human. |
| A provable, immutable record | Signed, hash-chained audit (the Operating Record): tamper-evident, verifiable offline. |
| Evidence on demand | Proof Pack: an Ed25519-signed bundle that verifies offline and refuses to fabricate. |
| Provable safety posture in CI | lightwork safety --json: shield, sandbox isolation, and egress policy as a machine-readable assertion your pipeline can gate on. |
| Your data trains no one's model | It runs on your infrastructure: nothing leaves to be trained on. |
Six load-bearing governance invariants are checked across every one of the 2,020 specialist packs, then property-fuzzed up to 5,000 iterations with a non-vacuity control, so a passing result can't be vacuously true.
Your VPC: your cloud account, your keys. Nothing routes through us.
Fully offline: no required egress at all. The platform never has to reach the network.
Docker, Kubernetes, or a single VPS. Integrates with Salesforce and ServiceNow over the MCP server.
The Operating Record is a signed, hash-chained log of every governed action. Each entry signs the one before it. Alter a single row after the fact and the chain breaks, so tampering is detected, not assumed away.
The Proof Pack is an Ed25519-signed evidence bundle: it verifies offline and refuses to fabricate a result it cannot prove.
The controls above map to the expectations behind the frameworks regulated teams report against. Lightwork is in alpha; we present control-mapping rather than badges. SOC 2 status and a full security overview are available on request.
No completed certification is claimed. We share our security overview and current SOC 2 status on request, and map your questionnaire to the platform control by control.
We'll map it to the platform, control by control.
