How we secure your agent infrastructure
Credential storage, protected transmission, access controls, plus our responsible disclosure process.
How we store and transmit agent credentials
Credentials are not stored as plaintext
Agent credential secrets are kept as salted hashes. Scalekix staff cannot view a raw credential value. At registration, the SDK retrieves the credential once and stores it in your environment; Scalekix keeps only the hash.
TLS on every connection
All traffic between your agent runtime and the Scalekix gateway uses TLS 1.2 or higher. The SDK requires TLS, and the gateway rejects plaintext connections. HTTP fallback is not available.
Encryption at rest
Audit log data and account configuration are encrypted while stored using established encryption. Encryption keys are managed separately from the data they secure, with access limited to the service layer that requires them.
Gateway separation
The Scalekix gateway does not keep agent request content beyond the metadata required to create an audit event. We record what the agent called, not what it sent or received. Your payload data does not transit or remain in Scalekix infrastructure.
Who can access what within your Scalekix account
Dashboard access by role
Dashboard users are assigned admin, operator, or auditor roles. Auditors can view and export logs. Operators can manage agents. Admins can manage billing and team access. These roles are limited to your account and are not shared across accounts.
SAML/SSO and MFA on Platform tier
The Platform tier includes SAML/SSO integration with your identity provider. Every tier supports multi-factor authentication for dashboard login. We recommend turning on MFA for every dashboard user, regardless of tier.
API keys for automated access
API keys used to automate account tasks, such as registering agents from CI, are limited to specific operations and can be revoked separately from dashboard access. We recommend using a separate API key for each deployment pipeline.
Our current status and roadmap
We are an early-stage product, so we want to state our compliance position plainly. We do not currently hold a SOC 2 certification. A SOC 2 Type II audit is on our roadmap, and we build access controls, audit logging, and data handling around SOC 2 Trust Services Criteria so the audit process is not added later as a retrofit.
If your organization has vendor compliance requirements, we are glad to review our current controls in detail and share our documented materials. Contact us at [email protected] or use the contact page.
How to report a security vulnerability
If you find a security vulnerability in Scalekix, please send the report directly to [email protected]. Please do not disclose the issue publicly until we have had a reasonable chance to investigate and resolve it.
Please include a clear issue description, reproduction steps, and the potential impact you identified. We will acknowledge your report within two business days and keep you updated during the investigation.
We do not run a formal bug bounty program at this stage. With their permission, we do recognize security researchers who report valid vulnerabilities in our changelog and release notes.
For issues unrelated to security, use the contact page or email [email protected].
Have a security question?
We are glad to discuss our security posture in more detail with organizations that have specific compliance or procurement requirements.