Security at STACK
STACK keeps access decisions, credentials and revocation outside the agent’s runtime and gives customers independent ways to verify those controls, even if the agent itself is compromised.
Security model
If an attacker takes control of an agent, they inherit only the access already granted to it. Those limits remain outside the agent’s runtime and are checked again on every request. Our attack tests begin from that compromised state, and customers can verify the controls using their own records and infrastructure.
Access is agreed before the agent starts
The Passport carries the agent’s permitted access and references the job and approval behind it. For a fleet Mission, STACK checks the live policy and membership, the Mission’s scope and remaining allowance, and the exact request before using a credential. Allowed work proceeds automatically. A rule that requires review holds the request until a person approves it.
The attacker controls its runtime and holds its valid Passport.
- Job, authority and identity✓
- Systems and actions✓
- Credential access✓
- Request limits✓
- Approvals, runtime checks and revocation✓
- Permitted data flows×
Due diligence
A security review covers the product and the company operating it. For STACK, that includes protection of customer data, operational controls, standards used at each trust boundary, and material available for independent review.
Customer data and cryptography
STACK handles account data, signed requests, selected payloads, credentials and audit records. The controls differ by data type; “encrypted” is not treated as one blanket property.
| Data | Protection | Important detail |
|---|---|---|
| Upstream credentials | AES-256-GCM envelope encryption with AWS KMS. In proxy-only mode, the credential is added only inside the boundary. | The agent receives the upstream response, not the raw credential. |
| Proxy responses | Only the final screened and redacted response is stored, encrypted with operation-bound authenticated encryption. | It can be read for up to 24 hours by an authorised caller, then the payload is scrubbed while non-payload metadata and hashes remain. |
| Identity evidence | The Passport carries opaque claim references. The underlying identity assertion is encrypted separately. | A receiving party can request the evidence it is authorised to see without placing PII in the Passport JWT. |
| Audit records | Append-only rows, per-operator hash chaining and signed records for material decisions and outcomes. | Retention depends on the plan. Customer exports can be retained outside STACK. |
| Data in transit | TLS 1.2 or later on the public API, MCP transport and dashboard. | The security of the final upstream hop also depends on the receiving service. |
| Data location | Application services run in Stockholm, the managed database in Frankfurt and platform KMS in eu-north-1. | Selected third-party services may process data elsewhere. The Privacy page records those relationships. |
| Customer-managed keys | Enterprise customers can use an AWS KMS key in their own account for the supported operator ciphertext stores. | Revoking the IAM grant makes covered decrypt operations fail closed. |