# Agents on your servers, under your rules, on the record.

> Where SecondStack runs, where your data lives, what is masked before a request leaves and who can do what: the answers a security review asks for.

- Canonical: https://secondstack.ai/for/it-security/

---

SecondStack is an AI agent platform. This view is written for IT and security teams: where it runs, where data lives, what is masked before a request leaves and what every run records.

SecondStack is self-hosted today: it runs on your own servers, and every chat, file and agent run stays in your own database. What goes out to an AI provider is checked first, with personal data and secrets masked by the rules you set.

## What the AI provider gets to see.

SecondGuard, the guardrails inside the gateway, swaps personal data and secrets for placeholders before a request leaves. The real values come back in the answer, on your side.

## Who can act, and with which accounts.

Each agent reaches only what it was given, and none of them ever holds a password. Its owner or an admin can pause it, any time.

- **Personal agent** (acts as its person): Google Workspace, Microsoft 365, GitHub; only the accounts that person connected.
- **Project agent** (works for a shared workspace): Project files, Project threads; never anyone's personal accounts.
- **Named agent** (hired for one role): Google Sheets · read only, Slack · its own bot; its own accounts, chosen by its owner, or none.

Who may call, train or manage an agent is set per person, team or the whole organization, and a deny beats any allow.

Credentials stay in a separate egress proxy, which adds them to each call: the agent gets the result, never the password.

## Every run leaves a record.

Each run of each agent writes the same eight lines: what started it, what it could reach, what left and what it cost. Administrators can read the record but not edit it. It holds what ran; the chat itself stays in your own database.

## Before your security review.

Where it runs, where data lives, who signs in and what is recorded.

- **Where it runs**: Self-hosted today, in your cloud or on your servers. Managed SaaS and AWS Marketplace are coming.
- **Where data lives**: Every chat, file and agent run in your own database, on your servers.
- **Sign-in**: Sign-in runs through ControlTower, the admin console. People sign in with SSO through Entra ID, Keycloak or another OpenID Connect provider, or through LDAP and Active Directory, and SCIM keeps your users in sync.
- **What is recorded**: What ran, not the chat transcript. Credentials and keys are stripped out. Deleting a conversation removes its content; the record keeps only that the run happened.
- **Certification**: ISO 27001 via T1A, our implementation partner.
- **Connections**: Google Workspace, Microsoft 365, GitHub, Jira and Notion built in; any MCP server or REST API by its URL. Channels: Slack and Telegram, Microsoft Teams coming.

## Questions from security reviews.

### Does SecondStack read our people's conversations?

No. Every chat, file and agent run stays in your own database, on your servers. Your admins see Agent Activity: what ran, not the chat itself.

### Can an agent act on someone's behalf?

Only the personal agent, and only through accounts that person connected. Named agents use accounts their owner gives them, or none. A project agent works from the shared workspace's files, not from anyone's personal accounts. In every case the credential stays in the platform's egress proxy, never with the agent.

### How do we control which AI models are allowed?

In ControlTower, the admin console, per organization, team, person, key or named agent, with deny as the default. Agents use the same list: a named agent on its sponsor's budget gets its own allowed models; any other agent uses the list of whoever runs it.

### Which identity provider does it use?

ControlTower is the platform's OpenID Connect provider and user directory, so people sign in once for the web app and the admin console. It connects to your identity provider over OpenID Connect, or to LDAP and Active Directory, with SCIM for user sync.

### Is SecondStack itself certified?

Not as a product today. ISO 27001 is held by T1A, our implementation partner. SecondStack runs on your own servers, so your data stays in your environment.

## Further reading

- [Shadow AI: what it is and how to detect it](https://secondstack.ai/blog/shadow-ai-detection/)
- [LLM governance: a working framework](https://secondstack.ai/blog/llm-governance/)
- [LLM guardrails: PII and secrets before egress](https://secondstack.ai/blog/llm-guardrails/)

## Bring one agent you would not allow today.

On the demo call we show how it would run as a named agent and what its record in ControlTower would show. You decide whether that is enough.

Book a demo: hello@secondstack.ai