Trust and security at CreateOS
How CreateOS governs every request before it reaches a model, validates every response before it reaches a user, and handles your data, with zero data retention by default.
- ISO 27001 certified
- SOC 2 Type II
- Zero data retention
- No training on your data
Agent Hub/Support Triage
Guardrails
Rules that block unsafe, off-topic or unwanted replies before the agent sends them.
Apply guardrail to
Share with
Give people, groups or your whole organization access to this agent.
Manage accessAccountability for every agent action
Every agent has an identity and a human owner, acts inside approval gates, can be stopped and rolled back, and leaves evidence your reviewers can read.
- Agent identityEvery agent runs under its own identity, so each action traces back to the agent that took it.
- A human ownerEach agent has a named owner on your team who answers for what it does.
- Approval gatesActions above the thresholds you set wait for a person to approve them.
- Kill switch and rollbackStop an agent at once, and roll it back to a known-good version.
- Audit trailEvery decision and action is logged step by step, as evidence for security and compliance review.
Controls on every request and every response
- Governed inferencePrompt-injection checks, policy validation, and access controls run before the model sees a request.
- Output validationPII masking and content filtering run before any response reaches a user, with hallucination checks configured per agent.
- Zero data retentionPrompts and documents are processed in-session. Nothing is stored by default.
- Full audit trailEvery call is logged with execution traces and SOC visibility across agents and workflows.
- Sovereign deploymentRun in CreateOS cloud, your VPC, or fully on-prem. Region-aware compute, no cross-border exposure.
- No training on your dataYour prompts, documents, and outputs are never used to train models, ours or a provider's.
Built to the standards regulated enterprises require
ISO 27001 and SOC 2 Type II are held by NodeOps, Inc., the company behind CreateOS, and cover CreateOS.
- CertifiedISO 27001Information security management certified to the global standard.
- AttestedSOC 2 Type IIIndependently verified controls for enterprise data protection.
- PrivacyZero Data RetentionIn-session processing. Nothing stored by default.
- ResidencySovereign InfrastructureRegion-aware compute with no cross-border data exposure.
Where your data lives and how it moves
Encrypted in transit and at rest
TLS in transit, AES-256 at rest, across every deployment mode.
Region residency
Pin processing to a region. No cross-border data exposure.
Access controls
SAML/SSO, role-based access, and per-team scoping on every workflow.
Subprocessor transparency
A current list of subprocessors and a DPA are available on request.
Deploy
Push from GitHub
Pick a repo and branch. Redeploys on every push.
Push a Docker image
Paste an image URL or Dockerfile, set ports and env.
Drop in files
Drag a .zip or folder. The framework is detected.
Live now
- claims-triage-apiProduction · eu-west4h ago
- contract-review-uiYour VPC · us-east12h ago
- support-digestProduction · eu-west2d ago
Report a vulnerability
We welcome reports from security researchers. If you believe you have found a vulnerability, email the details to our security team. We acknowledge within two business days and work with you on a fix. We support safe harbor for good-faith research.
Security questions, answered
Do you train models on our data?
No. Your prompts, documents, and outputs are never used to train CreateOS models or any provider's models. Data is processed in-session and not retained by default.
Where is our data processed?
You choose. CreateOS runs in our cloud, inside your VPC, or fully on-premise. Compute is region-aware, so you can pin processing to a region with no cross-border exposure.
What certifications do you hold?
We are ISO 27001 certified and SOC 2 Type II attested. Both are held by NodeOps, Inc., the company behind CreateOS, and cover CreateOS. Request the reports and controls documentation in the security pack from legal@nodeops.xyz. We operate on zero-data-retention, sovereign infrastructure.
How do you handle PII?
Output validation masks PII and filters content before any response reaches a user. You can configure policies per workflow and per team.
Can we use our own SSO and access controls?
Yes. CreateOS supports SAML/SSO and role-based access controls, scoped per team and per workflow.
Can we get a DPA and subprocessor list?
Yes. A Data Processing Agreement and a current subprocessor list are available on request. Email legal@nodeops.xyz.
Bring us one stuck workflow.
We take it to governed production with you, on your systems, in weeks, not quarters.