Security
What we hold, what we don't, and how to reach us if it matters
Anlyon executes your agent's production calls for it, which means it holds the credentials those calls need. Here is exactly what that means for your keys and your data.
The vault is write-only
Secrets go in through one call, `secrets.put()`, and there is no method anywhere in either SDK that returns a value back out. Not to you, not to your agent, not to a support tool. `list()` and `get()` return names and metadata only.
A secret is only ever decrypted for the milliseconds it takes to make the outbound call an Action requested, on Anlyon's side. The model that asked for "send_invoice" never sees the Stripe key that ran it.
Each stored secret is encrypted with AES-GCM under a key derived per store (HKDF), and the ciphertext is bound to the store and workspace it lives in, so a value copied between tenants fails to decrypt instead of silently working somewhere it shouldn't. Redis, which caches hot values for latency, only ever caches the ciphertext. If Redis is dumped or snapshotted, there is nothing readable in it.
A staging key cannot reach production
Every API key is bound to exactly one environment. There is no fallback that lets an unnamed request quietly resolve to "whichever environment is default" on a key-authed path; a caller resolves its environment explicitly or the request fails. That is the difference between environments being a label and environments being a boundary.
The kill switch follows the same rule: halting an environment stops the agent acting and stops anything leaving it, with one call from an operator key. It stops new dispatch, so a request an external server has already accepted is not recalled; what has not left yet does not leave, and what you send still queues rather than being thrown away. A halt that missed something it should have stopped would be worse than no halt at all, so it is enforced at the point where actions execute rather than only where they are created, and if the halt state cannot be read at all, the answer is halted.
A production environment can be marked protected, which blocks destructive changes unless the request explicitly confirms it. Turning protection off is itself guarded. Halt and resume are deliberately exempt from that guard, because an emergency stop has to stay reachable no matter what else is locked down.
Status, plainly
SOC 2
We intend to pursue SOC 2. There's no audit date yet, and I'm not going to publish one I can't commit to: Anlyon is built and run by one person today, and a compliance calendar is worth less than an honest one. When there's a real date, it replaces this sentence.
Self-host / bring-your-own-vault
Hosted is how Anlyon runs today, and the guarantees above hold because we're the ones enforcing them. Self-host and bring-your-own-vault are a committed roadmap item, not a maybe, targeted for next year, not yet scheduled to a specific quarter. If it's a blocker for you now, email support@anlyon.com and say what it would take. It shapes the order we build it in.
What isolation doesn't cover yet, honestly
Environment scoping is enforced for the resources that carry your data and your agent's side effects: messages, memory, workflows, runs, approvals, URL groups, flow-control keys, execution logs, and the secrets vault. What is still workspace-scoped is the key that signs outbound deliveries: a signed delivery names its environment inside the signature, so staging traffic can't be presented to your verifier as production, but the key material itself is shared and rotating it rotates for every environment at once. That's a tracked gap, not a hidden one, and it's the kind of thing this page will keep naming as it closes rather than quietly dropping. URL groups, flow-control keys and execution logs were all on that list until September 2026; they are scoped now, and the sentence is shorter rather than gone.
If something looks wrong
Email support@anlyon.com with "security" in the subject line. As a solo-founder company right now, that inbox is read by the person who wrote this vault, and you'll get a real reply, not a ticket number.
Give your agent a way to act
Free tier, no credit card. One command if you use Claude or Cursor.
claude mcp add anlyon -- npx -y @anlyonhq/mcp-server