Security by design.

No. CloudThinker never trains models on customer data. We use enterprise-grade LLM endpoints (Anthropic, OpenAI Enterprise, AWS Bedrock, Azure OpenAI) under zero-retention contracts that contractually prohibit training. Your prompts, responses, code, and operational data are used only to serve your requests, then discarded or stored only as you configure.

We use SOC 2 / ISO 27001 certified providers with zero-retention enterprise tiers: Anthropic, OpenAI Enterprise, AWS Bedrock, and Azure OpenAI. You can pin the platform to a single provider or bring your own endpoint (including self-hosted models) if you need to keep all inference inside your perimeter. All provider traffic flows over TLS 1.3, with sensitive fields redacted by the Guardrails Engine before they leave the platform.

The Guardrails Engine performs automatic redaction on every prompt before it reaches a model provider. PII / PHI patterns are masked, and secret detection blocks credentials, API keys, and tokens in prompts, code, and tool outputs. Stored data is encrypted at rest (AES-256) with per-workspace keys; field-level encryption is available for sensitive customer attributes.

Multiple safeguards layered together. Per-agent tool allowlists restrict which actions each agent is allowed to call. Graduated Autonomy (Notify → Suggest → Act-with-approval → Autonomous) lets you choose how much independence each agent has. High-impact operations require explicit human approval by default. Sandbox Isolation runs every action in an ephemeral microVM with egress policies. And every decision is recorded with full reasoning context, so anything can be reviewed or rolled back.

Over private, mutually authenticated links, never the public internet. CloudThinker SaaS supports Site-to-Site VPN, VPC Endpoint (AWS PrivateLink), and VPC Peering into your cloud environment, with no inbound public traffic required on your side. Combined with short-lived, scoped credentials issued per task, your production perimeter stays closed to the outside world.

Yes. CloudThinker supports Bring Your Own Cloud deployment in your AWS, Azure, or GCP account, and it stays fully managed by CloudThinker: operations, upgrades, and patching are handled for you. The control plane and data plane both run inside your cloud perimeter, so customer data (agent traces, audit logs, knowledge base, vector embeddings) never leaves your environment. We provide Terraform modules and a guided deployment with your security team.

CloudThinker is SOC 2 Type II certified, with annual independent audits. The full trust center, SOC 2 report, DPA, and security questionnaire are available at trust.delve.co/cloudthinker. HIPAA, ISO 27001, and PCI DSS readiness are supported through BYOC deployment patterns, and additional certifications are on the roadmap.

Untrusted inputs (tool outputs, document content, third-party data) are screened by injection-defense classifiers in the Guardrails Engine before they enter the agent context. We combine this with strict tool allowlists per agent and approval gates for sensitive operations, so the blast radius of a successful injection is bounded. Audit logs capture every screened input so you can investigate after the fact.

Every agent action is recorded with its full reasoning trace: the prompts that were sent, the tools that were called, the outputs received, and the decisions made. Audit logs are immutable, tamper-evident, and exportable to your SIEM (Splunk, Datadog, Elastic, etc.). Reviewers can replay any decision in context and roll back state-changing actions through the same runbook system that produced them.