We sell to security teams, so security isn't an add-on here — it's built into the base product, not saved for a pricier tier. Here's exactly how Vaii protects your data and keeps your agents from becoming a way in.
Every agent, assistant, and integration you connect holds access — OAuth scopes, API keys, the ability to read data and take action. They are non-human identities with standing privilege, and most of them live outside the identity tooling built for employees. When one is compromised, the blast radius is your environment.
The April 2026 Vercel breach began at a third-party AI tool: stolen OAuth tokens from a connected app became a foothold into a production environment. It's the now-standard shape of an AI supply-chain attack — the AI app doesn't have to be malicious, it only has to hold privilege and get compromised.
Vaii doesn't stop the malware — that's your endpoint and secrets tooling. We make sure a compromised agent identity isn't carrying broad standing privilege it can use silently: consequential actions route through policy (allow / require approval / deny), and every call an agent makes is recorded. Least privilege and a complete audit trail for the identities your other tools don't even see.
Every API caller is a principal with a kind (user, agent), an organization, a status, and a parent (for agents acting under a user). The principal model maps cleanly to ISO/IEC 24760 identity management: one entity, many roles, fully revocable.
Five scopes live on every token in tokens.metadata.scopes:read_memory, write_memory, mint_tokens, manage_org, view_audit. Routes that mutate state require an explicit scope check. Mint cannot escalate — a token without manage_org can't mint a token with it.
MCP clients (Claude Desktop, ChatGPT) discover us via RFC 8414 metadata, register dynamically via RFC 7591, and complete the auth_code+PKCE flow. Refresh tokens rotate on every exchange with replay detection — a stolen refresh token surfaces immediately as an invalidation event.
Email-domain-routed sign-in. We handed the SAML/OIDC complexity to WorkOS and focused our code on the principal-reconciliation step. SCIM-style provisioning ships when the first Enterprise customer needs it.
The app connects to Postgres as a role (acp_app) with SELECT and INSERT on audit_events and no UPDATE or DELETE grant. A bug, a compromise, or a malicious admin cannot tamper with audit history. Only a privileged DBA with separate credentials can — and only for explicit retention archival.
The audit middleware runs after auth and before the route handler. It records principal_id, organization_id, method, path, response status, request_id, and optional kind/object annotations from the route. Errors are captured too — 5xx and 4xx are first-class.
Inspired by SPDX/CycloneDX SBOMs. Every agent in your environment is inventoried with its vendor, capabilities, delegation chain, and recent activity. Studio-deployed agents auto-register; third-party agents (Claude Desktop, ChatGPT) register on first use. Export an ABOM document for vendor reviews and audits.
Every memory packet carries retention_days, expires_at, legal_hold, and archived_at columns. A partial index targets expired-non-held-non-archived rows for cleanup. The schema is the contract — enforcement code can't drift from the column definition.
Every organization carries a region column. Today every organization runs in us-east. The architecture is ready for regional sharding when an enterprise customer requires it; we don't pretend to multi-region until we are.
GET /v1/me/export returns a full JSON dump of every memory, token, audit row, and usage record attributable to your principal. DELETE /v1/me requires a typed confirmation, guards against last-owner deletion, and preserves audit_events for legal continuity.
Per-principal usage meter tracks embedding tokens and agent-run tokens separately. Each plan tier carries a monthly cap; the push route returns 429 once exceeded. No surprise overages, no runaway LLM bills.
Reach out — security questions get fastest replies.