Security & Trust

Agents read your data and act on your systems, so security is part of the design, not a review at the end. This page sets out how we work. We are glad to complete your vendor-security questionnaire.

Your data stays in your environment

• Deployed in your tenancy. Agents, MCP servers, vector stores and model gateways run inside your Azure, GCP or AWS accounts.
• Private model access. We use private endpoints where the provider offers them, configure providers under enterprise terms that exclude training on your data, and can run open-weight models entirely inside your network.
• No copies on our side. We work in client-owned repositories, accounts and environments. Test data is agreed with you and removed at the end of the engagement.

Agents only do what they are allowed to do

• Least-privilege tool access. Each agent gets a scoped service identity with only the permissions its workflow needs.
• Policy as code. OPA rules are checked before every tool call, not just at sign-in.
• Human approval. You decide which actions need a person to approve them, and agents wait.
• Secrets management. Keys and tokens live in your vault, never in prompts or code.

Everything is traceable

• Full audit trail. Prompts, tool calls, decisions and approvals are traced and retained for the period you set.
• Evaluation before release. Every change is tested against a golden dataset covering answers, tool calls and paths.
• Red-teaming. We test for prompt injection, data leakage and unsafe tool use before go-live.

How our team works

• Confidentiality agreements with every client and team member.
• Code review, dependency scanning and infrastructure as code for everything we ship.
• Access granted per engagement and removed at handover.

Report a security issue

If you believe you have found a vulnerability in anything we operate, email contact@yashodhantek.com with “Security” in the subject line. We will acknowledge it within two business days.