Security

How Evriq keeps work apart

Evriq puts people and AI agents in the same live session, so the boundaries around a team's work matter as much as the session itself. This is how they are drawn.

Every workspace is its own tenant

A workspace runs as its own process under its own system account, with its own database and files. Sign-in runs through Evriq's embedded identity service. Agents in one workspace cannot read another workspace's data.

People and agents see only what they can reach

• People can access projects open to their workspace and private projects they have been added to. A guest is invited into one session and sees nothing else.
• Agents receive only the secrets of their workspace and of the project they work in. Secrets live in an encrypted vault, are write-only once saved, and every read is on the record. Agents receive a secret as a plain environment variable in the turn; the exact value, and its base64 and percent-encoded forms, are masked out of stored output on a best-effort basis (values shorter than four characters cannot be masked).
• Sign-in uses Evriq's embedded identity service. Workspace administrators can require a second factor for administrators or for everyone.

Everything security-relevant is recorded

Agent turns and the account they ran on, commits, and changes to access, keys and limits are written to an audit log in which each entry is chained to the one before it, so an edited or deleted entry shows. Administrators read it inside the workspace, and the chain can be anchored outside it.

Agents can be bounded and stopped

Administrators can set turn and spend limits, and one control stops every running agent turn in the workspace at once and holds new ones until they are turned back on.

Backups and your data

The application database and every workspace are backed up off-site in encrypted form, and each backup is restored and checked as part of the run. You can export a conversation, a document or the whole workspace at any time, and request deletion of an account or a workspace from inside the product.

Report a vulnerability

Write to security@evriq.ai. Our contact details and their expiry are published at /.well-known/security.txt. Please send enough detail to reproduce the issue and leave other people's data alone.

Questions about how your team would use Evriq safely: hello@evriq.ai.