What we connect to and install, what we store and where, how we isolate your data, and how Aegis supports the frameworks you report against.
| Aspect | SaaS on Google Cloud | On-prem appliance |
|---|---|---|
| Status | Generally available | Generally available |
| Tenancy | Separate database per customer on shared compute | Single tenant, in your network |
| Identity | Separate identity pool per customer | Bundled single sign-on (OIDC), or your identity provider |
| Updates | Continuous | Signed release manifests, downgrade-protected |
| Licensing | Subscription | Offline signed licence. Expiry drops to read-only, never deletes. |
| Outbound | n/a | None required. Optional signed updates and counts-only usage. |
| Data location | Google Cloud, US regions | Your network |
| Retention | You set how long data is kept | You set how long data is kept |
Clouds and SaaS apps connect read-only, with nothing installed. Laptops get a managed browser extension and endpoint agent.
One read-only IAM role per account. Aegis uses short-lived credentials through STS, with an ExternalId unique to you. Three checks before any scan: the role can be assumed, the identity call works, and the account ID matches the one you declared. To compare granted with used access, Aegis also reads CloudTrail events and IAM last-accessed data, read-only.
Never: secret values, object reads, or model invocation.
Read-only access, scoped to the subscriptions or projects you choose. Discovery reads resource settings and names: Azure Functions, AKS, Virtual Machines and AI Foundry; Cloud Run, Cloud Functions, GKE, Compute Engine and Vertex AI Agent Engine.
Never: writes to your subscriptions or projects.
An External Client App. Credentials are sealed in a secrets manager; our database keeps only a reference. Verification reads one User record ID.
Never: passwords, JWT keys or refresh tokens. We never run an agent or write to your org.
Read-only access to agent configuration. Slack and Stripe connections are read for the scopes your agents' credentials carry.
Never: runs an agent or writes to the app.
A managed browser extension for Chrome and Edge and an endpoint agent for macOS and Windows. They find AI apps, coding agents and local MCP servers, and apply your block, warn and masking rules on the device.
Never: prompt or file content leaves the laptop. Only metadata reaches Aegis.
One shallow clone of the repositories you choose to connect, checked for committed secrets and unsafe patterns.
Stored: rule, file and line. Never the secret itself.
"We chose separate databases over a shared table with a customer column. A shared table is one missing filter away from a cross-customer leak."
OIDC with PKCE. Tokens never reach browser JavaScript; they sit in a sealed, HttpOnly cookie with server-side refresh. Writes are origin-checked.
Actor, action, resource, result and IP, written in its own transaction so a rejected request still leaves a record.
Enforced server-side across users, connections, scans, triage, policies, audit export and billing.
Container images pinned by digest and security scanners pinned by version. Appliance releases are signed and cannot be downgraded.
Measured 24 September 2026, SDK path with the network mocked.
AIUC-1 evidence is a product capability. The other rows describe how Aegis controls support your work against each framework. They are not certifications or attestations.
| Framework | How Aegis supports it |
|---|---|
| AIUC-1 | Maps runtime decisions to requirement IDs with a written reason, e.g. block → B006, D003; mask → B005, B009, A006; hold for approval → C007, C009. Deployer-side evidence, not certification. |
| NIST AI RMF 1.0 | Map: inventory of agents and what they reach. Measure: confidence and risk scores, run traces. Manage: policy decisions and approvals. Govern: versioned policy, roles, audit log. |
| OWASP Top 10 for LLM Applications (2025) | LLM06 Excessive Agency (tool and parameter bounds, approvals) · LLM02 Sensitive Information Disclosure (masking, redaction) · LLM10 Unbounded Consumption (rate and spend limits). |
| OWASP Top 10 for Agentic Applications (2026) | ASI02 Tool Misuse (policy before each wrapped tool call) · ASI03 Identity & Privilege Abuse (IAM blast-radius findings) · ASI10 Rogue Agents (discovery of unregistered agents, fail-closed denial). |
Compliance status. SOC 2 Type II. Report available under NDA.
Request the SOC 2 reportWe will walk through access, data handling and isolation, and take your questions.