Skip to content

Security overview

GaugeDesk limits agent access and records important actions. GaugeWright does not claim independent certification that it does not have.

Read this first

GaugeDesk does not provide local or confidential model inference. The selected model provider receives prompts and allowed context in plaintext.

For a website agent, GaugeWright's hosted runtime also processes visitor data.

Product controls

  • A run receives only approved files, tools, and actions.
  • Missing or invalid permission grants nothing.
  • A file identifier does not grant access to file contents.
  • A work chat cannot change its agent instructions.
  • Agent output remains proposed until review.
  • Protected content needs approval before release.
  • Audit history is append-only.
  • Website sessions use one fixed release.
  • Website credentials are bound to one approved provider and credential type.
  • Website collection is fixed at publication and cannot be widened by the running agent.

Company-operated controls

GaugeWright uses:

  • protected default branches;
  • secret, dependency, and static-code scanning;
  • SPDX software bills of materials;
  • build-provenance attestations;
  • encrypted backups and tested restore procedures;
  • production availability and security-event monitoring;
  • responder alerts and an incident-response procedure;
  • a privacy request process;
  • a standard Data Processing Agreement; and
  • a maintained subprocessor list.

Current limits

  • GaugeWright is founder-operated. Independent internal approval is not available.
  • The hosted control plane has no uptime SLA.
  • GaugeWright does not have a completed independent penetration test.
  • GaugeWright does not have a SOC 2 report or ISO 27001 certification.
  • Confidential model inference is not implemented.
  • Windows does not have the Linux and macOS instruction-isolation sandbox.

Tests and formal models support product claims. They are not an independent audit or certification.

Report a security issue

Use the method on Support. Do not put a credential, customer data, or exploit details in a public issue.

More detail: