Security

Where your data lives

The Delegus Check service runs on AWS in one region, us-east-1 (Northern Virginia). Its database (Postgres on Amazon RDS) is encrypted at rest. Its cache (Redis on Amazon ElastiCache) is encrypted at rest and in transit. Every connection to the API uses TLS.

What we keep for each check

For each check we keep the signed receipt, the decision and its reason, the time, and the action that was checked: its type, the resource, and the amount and currency if there is one. We don't keep the request body, and we don't keep the grant or the agent's proof. The receipt carries their hashes instead.

Receipts are stored in an encrypted database, backed up daily to a vault that keeps each copy for seven years under a compliance lock. Receipts are private. Only the service that asked, the company the receipt names, and Delegus staff can retrieve one. Anyone holding a receipt can check its signature offline, without asking us.

The keys, status lists and profiles a receipt depends on sit in write-once storage (Amazon S3 with Object Lock in compliance mode) under a seven-year lock that no one, including Delegus, can lift.

How keys are held

Our signing keys. Receipts are signed with Ed25519 keys held in AWS KMS. The private key never leaves KMS, and only the API service can ask KMS to sign. No person signs receipts. We never remove an old signing key, so old receipts stay checkable.

Your API keys. We show a key once, when you create it, and store only a SHA-256 hash of it. Nobody at Delegus can read your key. You or we can revoke it.

Keys we hold for your company, if you choose. If your company lets Delegus hold its signing key, that key is an Ed25519 key in AWS KMS, one per company. Delegus signs a grant with it only after one of your people approves those exact bytes with a passkey.

Subprocessors

These services process customer data for us:

• Amazon Web Services, us-east-1: the Delegus Check API, its database, cache, signing keys and evidence storage.
• Vercel: hosts the console at app.delegus.ai.
• Neon: the console’s database.
• Resend: sends sign-in links and account email.
• Stripe: billing and payments.
• Anthropic: staff tools only, with credentials and the local part of email addresses masked before anything is sent.

For regions and anything this list doesn’t answer, write to hello@delegus.ai.

Contracts and certifications

A data-processing agreement is part of the Enterprise plan. We don't hold a SOC 2 report today. Getting one is a goal, and we'll say so here when we have it.

Reporting a problem

Write to hello@delegus.ai with the subject "Security", saying what you found and how to reproduce it. We reply as quickly as we can, and we keep you updated until it is fixed. Please test in the free sandbox in your own account, not against anyone else's data. Service status is at delegus.betteruptime.com.

The detail

Engineers and auditors can go deeper in the docs, starting with security controls, infrastructure security, the evidence layout and the threat model mapping.