Escepine logoescepine
Security Architecture

Execution without exposure.

Escepine is an execution plane. We run your workflows, enforce your policies, and record the evidence. We do not read your data, train on your payloads, or hold your credentials beyond the life of a single run.

Core Principles

Zero Standing Access

Agents receive credentials when a run starts. Access is revoked the millisecond the run ends. Nothing persists.

Evidence, Not Telemetry

Every state transition, tool payload, and policy decision is logged to an immutable ledger. You can replay any run.

Policies Outside the Model

Security constraints are enforced by the runtime, not the prompt. The model cannot bypass rules it never sees.

Sandbox Isolation

Every tool execution runs inside an isolated, ephemeral container. The agent has no access to the host environment, network, or filesystem outside the sandbox.

  • Containers are spawned per-step and destroyed on completion.
  • No shared memory between concurrent runs or tenants.
  • E2B-based sandboxing enforces CPU, memory, and execution time limits.

Data Handling

Escepine does not train on your payloads. We do not use your SOPs, prompts, or tool outputs to improve our models or any third-party model.

  • State is encrypted at rest (AES-256).
  • All data in transit is protected via TLS 1.3.
  • Payloads are retained only for the duration of the active run unless you opt into the Evidence Ledger.

Runtime Policy Enforcement

Guardrails written into prompts live inside the context window. They can be ignored, overridden, or pushed out by context bloat. Escepine moves these rules outside the model entirely.

  • Spend caps, PII guards, and approval gates are enforced by the engine before the model ever sees them.
  • Schema checkpoints halt execution the moment a shape deviates.
  • Hard iteration caps and timeouts kill runaway loops before billing spikes.

Compliance Roadmap

We are building Escepine to meet the requirements of regulated industries from day one.

SOC 2 Type I Readiness: In Progress

We are currently implementing the controls and documentation required for SOC 2 Type I attestation. Target completion: Q1 2027.

  • Audit logging is already active on all runs.
  • Role-based access controls are enforced at the API layer.
  • Incident response procedures are documented and tested.

Security Questions?

For security inquiries or to request our full architecture review, contact our engineering team.

escepine@proton.me