Isolated production services
Each early access engagement has a dedicated service deployment, application database, and service-scoped object storage permissions. Its training environment on GCP is also isolated.
Enterprise agents - Security Overview
Understand the boundaries around your agents.
Deployment, access, and customer learning isolation.
LatentSpin helps teams operate agents within boundaries: control access, inspect execution, and govern how learning becomes part of production work. Customer learning stays isolated, while review, evaluation and version control support accountable updates. Your team retains oversight of sensitive decisions, with visibility into what agents do and how they improve.
01 / Deployment & data protection
Isolation where it matters. Documented controls throughout.
For early-access customers and design partners, each engagement has dedicated application and training environments. LatentSpin operates the underlying inference infrastructure, which may be shared; customer knowledge and adaptations remain isolated.
US hosting and encryption
Core application and storage run on AWS. Customer data is stored and processed in US cloud regions; specific regions may change with GPU availability. Sensitive data is encrypted in transit with TLS and at rest. Integration credentials are stored in AWS Secrets Manager.
Private model serving
LatentSpin hosts and operates open-weight inference models on cloud GPUs. Cloud providers supply compute, but customer data is never sent to third-party model APIs.
How engagement isolation works · conceptual architecture
Engagement A
Engagement B
LatentSpin-operated open-weight inference
Shared serving infrastructure may be used, but knowledge and adaptations remain scoped to the agent and customer.
Illustrative only. Each inference request uses the knowledge and applicable adapter selected for that agent; customer adaptations are not pooled.
02 / Access & integrations
Access is explicit, scoped, and reviewable.
Authentication does not automatically authorize access to connected business systems. Permissions are agreed upon during onboarding.
Customer identity
Google sign-in through Amazon Cognito uses an account identifier, name, email, email-verification status, and profile picture. Access is limited by approved email addresses or domains.
Connected systems
Integrations need separate authorization and use only the connected account's granted permissions. Google sign-in alone does not provide Google Drive or other business-system access.
Multifactor authentication
Customer MFA follows the organization’s Google identity policies; LatentSpin does not add another customer MFA challenge.
Customer access and offboarding
Individual user removal is coordinated with LatentSpin and the customer’s Google administrator. At engagement end, the isolated service stack is undeployed, cutting off application access, including existing sessions. Access removal is separate from contractual data retention and deletion.
03 / AI governance
Inspect the work. Govern the learning.
Customer inputs, instructions, results, agent definitions, uploaded content, history, tool results, and feedback are treated as customer-confidential information and may be processed to support that customer's workflows and learning.
01 / UNDERSTAND
Inspect the workflow
View workflows as readable steps and flowcharts, and review changes to understand intended behavior.
02 / VERIFY
Trace execution
Examine execution history, including individual tool calls, their inputs, and results. Compare planned actions with what happened.
03 / IMPROVE
Keep learning isolated
Agent-specific learned knowledge and separate LoRA adapters preserve customer boundaries without modifying the shared base model.
Customer learning stays with the customer's agents.
Even when inference servers or GPUs serve multiple engagements, one customer's learned knowledge and model adaptations are not applied to another customer's agents. Human oversight remains part of governance.
04 / Security operations
Security built into daily operations.
Our CTO owns the information security program. Documented controls, reviewed software changes, ongoing monitoring, and tested response procedures support the systems your agents depend on.
Disciplined access and delivery
Employee security training, documented staff onboarding and offboarding, least-privilege access, quarterly access reviews, MFA on critical internal systems, and reviewed software changes.
Continuous attention to risk
Vulnerability scanning and remediation, annual independent penetration testing, security logging and monitoring, and vendor risk reviews.
Preparation for disruption
Incident investigation, containment, recovery, and affected-party communications. Backup restoration and business continuity/disaster recovery procedures are tested at least annually.
05 / Independent assurance
Documented
controls
Security program · Independent assessment
Documented controls and independent assurance.
LatentSpin maintains a documented information security program supported by independent assessment and ongoing oversight. Contact our team to discuss applicable controls, assessment scope, and the materials available for your security review.
06 / Data lifecycle
Clear rules for every stage of your workflow’s lifecycle.
Data retention and disposal follow the applicable customer agreement, including application records, object storage, training-environment data, and learned adapters. Disabling access does not by itself determine when retained data is deleted.
Approved information
Agree on the categories of customer data the agent may process and the scope of learning during onboarding.
Integration permissions
Define connected systems and access scopes separately from customer sign-in.
Retention and deletion
Specify retention, deletion, and any additional data-handling or regional requirements in the engagement terms.
Security review
Review the boundaries with our team.
Discuss your deployment, integration permissions, learning isolation, and data-handling requirements before starting an engagement. We welcome customer security reviews and questions about the controls relevant to your workflow.
Security materials and any additional requirements are discussed in the context of your early-access or design-partner engagement.
Review with us
Plan a security review.
Share the workflow, connected systems, and review requirements your team needs to assess.