Security for AI agents in production
Cheqpoint is the security layer between your AI agents and the actions they take - scoring every action for risk, catching anomalies, and holding anything dangerous until a human clears it.
And the platform that enforces it is hardened end to end: encryption in transit and at rest, strict per-workspace isolation, immutable audit trails, and SOC 2 Type II in progress.
Behavioural Baselining
Risk scores are generated from each agent's historical request patterns - volume, action types, and time-of-day - independent of what the agent reports. A compromised agent that claims low risk is still flagged.
Data Encryption
Data is transmitted over TLS 1.3 and encrypted at rest with AES-256. Connection Keys are hashed and never transmitted in plaintext after creation.
Multi-Tenant Isolation
Your data is never visible to, shared with, or accessible by any other customer. Every query is filtered by workspace at the database layer - isolation is enforced on every read and write, not just at the API boundary.
Session Security
Sessions use HMAC-SHA256 signed cookies. No JWTs are stored in localStorage. Sessions rotate on sensitive actions such as password changes and permission changes.
Audit Trail
Decisions are permanently logged with reviewers and rules. Audit records cannot be edited or deleted through the product, and full history is exportable to CSV.
Connection Keys
Connection Keys are hashed before storage and can be rotated at any time. Rotating a key immediately invalidates the previous one.
Rate Limiting
Hourly and daily rate limits are enforced at the edge. Violations result in automatic rejection with a reason returned to the SDK.
SOC 2 Type II
SOC 2 Type II audit is in progress (expected Q1 2027). Enterprise customers can contact security@cheqpoint.co for pre-certification documentation.
Responsible Disclosure
Email security@cheqpoint.co to report vulnerabilities. We acknowledge reports within 24 hours and resolve critical issues within 72 hours.
Infrastructure
Hosted on Vercel (UK/EU regions). Database: PostgreSQL with automated daily backups and point-in-time recovery. We target 99.9% uptime. See real-time status at /status.
SIEM & Security Stack Integration
Forward every decision to your SIEM
Every approval, rejection, anomaly flag, and SLA breach is forwarded to your existing security stack in real time. Cheqpoint integrates with Datadog, Splunk, Microsoft Sentinel, Elastic SIEM, and CrowdStrike Falcon via outbound webhooks and CEF export - so your SOC team sees AI agent activity in the tools they already use.
Compliance
GDPR
ReadyFull GDPR compliance for EU and UK customers. DPA available. Right to erasure and data portability supported in-product.
Download DPACCPA
CompliantCalifornia Consumer Privacy Act. Residents can request data deletion or export from Settings. We do not sell personal data.
Privacy PolicyHIPAA
ReadyCheqpoint provides the safeguards required for HIPAA compliance, including RBAC, audit trails, and encryption. Healthcare customers can request a BAA.
Request BAASOC 2
ReadyControls mapped to all Trust Service Criteria. Formal Type II audit planned for Q1 2027. Security documentation is available on request.
Request docsEU AI Act
ReadyCheqpoint is designed to support the human oversight requirements of EU AI Act Article 14. Audit trails and decision logging are built in for high-risk systems.
How it worksISO 27001
AlignedOur controls align with ISO 27001 domains including access control, incident management, and cryptography. Formal certification planned following SOC 2 completion.
Contact usEnterprise security review?
We maintain a pre-answered security questionnaire covering data handling, access controls, encryption, compliance, and incident response - ready to submit to your procurement team. For custom documentation or vulnerability reports, email security@cheqpoint.co.