Security
How we protect your data and your agents.
What Thaliq does today to keep an organization's data and agents safe. If it is not built yet, it is not on this page.
On AWS, behind Cloudflare.
01 · Where it runs
The hosted service runs on AWS, in the US East (N. Virginia) Region, with Cloudflare in front.
- Private network
No public address.
The services run as non-root containers in private subnets, with no public IP address. Each one accepts connections only from the services that call it.
- Cloudflare
Cloudflare in front.
The console and the API sit behind Cloudflare, which also serves the widget. A tunnel that our own servers open to Cloudflare carries their requests to AWS, so nothing connects to the servers directly from the internet.
- Rate limits
Limits at the edge.
Sign-in, password recovery and the widget's public entry points are rate limited for each visitor address at Cloudflare, before a request reaches AWS. The console adds limits of its own for each address and each email.
- Your own servers
Or on your own servers.
If your data cannot be on the hosted service, a dedicated deployment is arranged with us. The whole stack runs with Docker Compose, in your cloud or on a network with no internet. The images are signed and come with their SBOM, and the license works offline.
Encrypted, and kept apart.
02 · Your data
How data is protected on the wire, where it is stored and between organizations.
- In transit
Encrypted on the wire.
The console, the API and the widget are served over HTTPS, and the tunnel to AWS is encrypted. Our services reach the database and the queue only over TLS. On the hosted service, your agents call your tools only over HTTPS.
- At rest
Encrypted where it is stored.
The database's storage, the queue and the storage for data exports are encrypted. Our own credentials sit in AWS Secrets Manager, encrypted with a key of our own that rotates every year.
- Your secrets
Sealed one by one.
The credentials you give a tool are encrypted with AES-256-GCM under a key of your organization before they reach the database, and the console never shows them again. Passwords, secret API keys and session tokens are stored only as hashes.
- Organizations
Each organization stays apart.
Every table that holds an organization's data enforces row-level security in PostgreSQL, so a query sees only the rows of the organization it runs for. The services connect with database roles that cannot bypass it, and a check at startup refuses a role that could.
- Backups
Restorable to any point in the last 14 days.
The database is backed up automatically. On Oct 13, 2026 we rehearsed a point-in-time restore into a separate instance and compared the row count of every table with production.
- Retention
Your data, and the way out.
Text in Lens traces is cleared after 30 days unless an agent sets another period, from 1 to 3650 days. The owner can export the organization's data and ask for its deletion, which waits 30 days so the owner can still cancel it. An owner or an admin can erase an end user.
Who can do what, on record.
03 · Access
Roles, a log of every change, and sign-in that resists guessing.
- Roles
Five roles, from owner to viewer.
Owner, admin, operator, supervisor and viewer. Each role can do what the ones below it can, and a role the system does not know can do nothing. Publishing or rolling back a version by hand and changing where a tool sends its secrets need an owner or an admin. Deleting the organization needs the owner.
- Audit log
Every change, on record.
Every write in the console is recorded: who made it, what changed and when. Owners and admins read the log, and it is kept for 12 months.
- Sign-in
Passwords that resist guessing.
Passwords need at least 15 characters and are stored as argon2id hashes. A wrong password and an unknown email get the same answer. After 10 failed sign-ins in a row an email is locked for 15 minutes, and every address and email also has an attempt limit.
- Sessions
Short sessions, strict cookies.
A session lasts up to 7 days and ends after 8 hours without a request. The cookie is HttpOnly, Secure and SameSite=Strict, and the console cannot be embedded in another site. A new password ends the member's other sessions; deactivating a member ends them all and revokes their tokens.
- Logs and alerts
The account is watched.
AWS CloudTrail keeps the account's audit trail for 365 days, with log file validation. Amazon GuardDuty watches the account and the database's sign-ins, and emails us the findings of medium severity or higher. Network flows are logged for 30 days.
People decide what is sensitive.
04 · Your agents
Controls that keep an agent inside what you allow.
- Approvals
A person decides first.
A policy can hold a call that writes data or moves money until someone with the right role approves it. If nobody decides before the timeout, the call is rejected. Approvals are made in the console by a signed-in member, never with an API key, and each decision is recorded.
- Evals and guardrails
Checked before and while it answers.
A new version of an agent with an Eval goes out when it passes. If it gets worse, the current one keeps answering. Only an owner or an admin can publish one that did not pass, as an exception with a written reason. Guardrails check sensitive messages and answers. Evals and guardrails come with Enterprise.
- Lens
Every step, traced.
Lens records each conversation step by step: model calls, tool calls, approvals and what they cost. Before a trace is stored, emails, payment card numbers, phone numbers, Peruvian DNI and RUC numbers and bearer tokens are masked.
- Webhooks
Signed, so you know they are ours.
Events sent to your systems are signed with Standard Webhooks. Each carries an id and a timestamp, so your system can check the sender and refuse a replay, and a failed delivery is retried with the same id.
Where the model runs.
05 · Models and providers
The hosted service answers with Claude Haiku 4.5 on Amazon Bedrock.
- Regions
Model requests can cross Regions.
Thaliq runs in AWS's US East (N. Virginia) Region. Model requests use a global inference profile, so AWS can process them in other Regions.
- What AWS states
AWS's word on your prompts.
AWS states that model providers have no access to Amazon Bedrock logs or to customers' prompts and completions, and that neither AWS nor the providers use inputs to or outputs from Bedrock to train models.
- Subprocessors
Who else handles data.
The services that process data for us are listed in the Data Processing Addendum, with what each one does.
Found a vulnerability? Tell us.
Write to [email protected] with the affected component, how to reproduce it and the impact you saw. Please keep the details private until we have fixed it. For any other question about security, talk to us.