Your agent acts with keys it never sees
Anlyon makes your agent's calls for it, so it holds the keys those calls need: yours, and each of your users' own. Here is what that means for those keys, for your data and for your users.
The vault is write-only. Decrypted at the moment of the call.
A secret goes in through one call, secrets.put(). Nothing in either SDK returns the value: not to you, not to your agent, not to a support tool.
It is decrypted on Anlyon's side for the outbound call an action asked for, and nowhere else. The model that asked for the refund never sees the Stripe key that made it.
The model
asks by name
Your server
names the user
Anlyon
vault · policy · receipt
Provider
api.stripe.com
back to the model: result, no key
the key travels one hop, and only outward
An agent that holds a key can leak it, log it, or be talked into using it. With Anlyon the key never reaches the agent, so there is nothing in its context to give away.
Less risk
No key in a prompt, a log or a model's memory, and every call checked against its policy before it leaves.
Less cost
No secret store, encryption scheme or audit pipeline of your own to build and pass review with.
Less effort
Store a key once. Your agent calls the operation by name, and the record is written for you.
What Anlyon keeps. And what it never does.
What Anlyon holds
Your keys, and your users' keys
Encrypted with AES-GCM under a key derived per store, and bound to the workspace they live in. A value copied to another tenant fails to decrypt.
The audit record
Approvals, outcomes, policy versions, halts, keys and member changes, written in the same database transaction as the change itself.
Who each call was for
Calls, approvals and audit records carry the user the agent acted for, so one user's history can be read on its own.
What Anlyon never holds
A way to read a key back
No method in either SDK returns a secret's value. Listing and reading a secret return its name and metadata.
A key in the model's context
The model asks for an operation by name. The key is decrypted on Anlyon's side for the call, and never reaches the model.
Readable values in the cache
Redis caches ciphertext. A dump or a snapshot of it holds nothing readable.
Values from your own vault
A secret can point at AWS Secrets Manager or HashiCorp Vault. Anlyon reads it when it makes the call and does not store it.
Your users. One user's account stays that user's.
Your server names the user
A call for a user carries that user from your server, with your API key. The tools a model gets have no user field, so a prompt cannot switch users.
Each connection is confirmed
After a user connects, your server confirms it for the user who is signed in. A connect link forwarded to someone else attaches nothing.
No fallback to your accounts
A key that requires an end user never uses a workspace connection.
Approvals stay in the user's hands
In your app, a short-lived session token decides that user's own approvals. Your API key never reaches the browser.
Erase a user when they leave
Their connections are deleted, their limit counters reset and their pending approvals cancelled. Records stay, with the id replaced by a one-way hash.
Environments. A staging key cannot reach production.
One key, one environment
Every API key is bound to exactly one environment, with no fallback to a default. A caller names its environment or the request fails.
A halt that fails closed
One call from an operator key stops anything leaving an environment. It is enforced where actions execute, and when the halt state cannot be read, the answer is halted.
Protected environments
Destructive changes need an explicit confirmation, and turning protection off is guarded too. Halt and resume stay reachable.
- staging200
- productionrefused
Who decides? Approvers, roles and the record of it.
Approvers
Decide in the console, through the API, or with the buttons on a Slack message that shows the exact request.
Roles per environment
Someone can be a member in staging and an approver in production.
Single sign-on and SCIM
OIDC or SAML can be required for a workspace. Removing a person from your directory revokes the keys they created.
Audit streaming
Records stream to a signed webhook, an S3 bucket, Datadog or Splunk, and export as JSON or CSV.
SOC 2 and your own vault. Where things stand.
SOC 2
We intend to pursue SOC 2. There is no audit date yet, and we will not publish one we cannot commit to. When there is a real date, it replaces this sentence.
Bring your own vault
Credentials can stay in your own AWS Secrets Manager or HashiCorp Vault. A secret points at a path there, and Anlyon reads the value when it makes the call.
If something looks wrong, tell us.
Email support@anlyon.com with "security" in the subject line. It is read by the person who wrote the vault, and you will get a real reply, not a ticket number.