Security review
Architecture, data flows, roles, questionnaire answers, and a control mapping, written to the same evidence standard as our engineering documentation. Every control carries its availability status.
Status on every control
Explicit non-claims
Customer-run deployment
01 / What you receive
We send these to security teams evaluating Decision Terrain, on request. Each document labels capabilities as standard, enabled per deployment, preview, demonstrated, or customer responsibility.
The four pillars: customer-run deployment with no connection back to Decision Terrain, contained execution, governed and stoppable agents, and a durable action record forwarded to your SIEM. Each pillar ends with what we do not claim.
Request the materialsArchitecture diagram, what leaves your boundary for each model choice, the role and permission model, and answers to 37 standard security-questionnaire questions.
Request the materialsThe same 37 answers as a spreadsheet, by domain, with an availability status for each, ready to adapt to your own questionnaire format.
Request the materialsWhich capabilities can provide evidence for NIST SP 800-53 Rev 5 controls, the NIST AI RMF functions, the OWASP Top 10 for LLM Applications 2025, and CMMC Level 2 practices. Marked supports, partial, or customer.
Request the materialsThese materials describe product capabilities. They do not establish that any control is implemented in your environment, and Decision Terrain holds no FedRAMP, DoD Impact Level, CMMC, or SOC 2 authorization.
02 / What we do not claim
Reviewers trust a vendor that marks its own limits. These are stated in every document above.
Running on your infrastructure is not by itself an offline or data-residency guarantee. Model and integration traffic goes to the providers you configure.
A security hold cannot recall an action an outside service already accepted. Those outcomes are reported Unknown, not success.
Detectors find patterns, not all sensitive content. Audit hashes support consistency checks; they are not a signed chain.
03 / For the buyer
If you are the person who wants agents working, the path-to-approval guide shows how to bring security in at the start, begin with read-and-draft work, and produce the evidence an approver needs at each step.
Seven steps from choosing one responsibility to an evidence-based decision, with what your security team receives at each step.
Request the materialsUse the OWASP agentic and NIST AI RMF checklists to record evidence and gaps for the deployment you are evaluating.
Open the checklistsNext step
Bring your questionnaire, framework, or a proposed workflow. We will go through each answer with your security team and show the controls in a running deployment.