Security
Security
How GFO approaches the security of the Agentic AI Operating Systems it engineers.
Draft — pending founder validation. This page summarises the GFO security approach. Formal security documentation and any certifications will be added once verified. This page is currently excluded from search indexing.
Security by design
Security and governance are core architectural layers in every GFO deployment, not features added afterwards. See enterprise AI security for a detailed explanation.
Core controls
- Scoped, least-privilege access to systems and data
- Identity controls and revocable credentials per integration
- Encryption in transit and at rest
- Complete, reviewable audit trails of agent actions
- Human-in-the-loop approval for sensitive steps
- Private or region-constrained deployment where governance requires it
ONE databases and storage
- Server-side store only, isolated volume, never in the browser
- OAuth tokens encrypted at rest (AES-256-GCM, TokenVault)
- Strict isolation by user id
- No data lake: no permanent email bodies
- Gmail bodies purged after 24 hours; full purge on account deletion
- Audit logs without tokens, bodies or full recipient lists
Responsible disclosure
To report a potential security issue, contact GFO via the contact page. A dedicated security contact and disclosure process will be published here once finalised.