Enterprise procurement
What Deixic changes, who approves it, and how it clears review.
Start with the authority you grant Deixic over production settings, then locate the current public facts on architecture, data, and security, and the items fixed in an enterprise agreement.
| Scope remediation authority | Name the systems Deixic connects, the change classes that run within your policy, the named approver for each sensitive change, and the owner of retention and exported receipts before another team joins; actions outside that authority are denied or sent to you as a decision. |
|---|---|
| Evidence and decision history | Every closed item has a receipt listing the changes, who authorized each, and the read-back checks; activity history keeps each request, decision, and result, and the activity and supporting material selected for a review can be exported. |
| Private deployment · Available | Versioned Helm charts and checksums for customer-operated Kubernetes; the charts hold templates, not images or credentials, and image access, identity, encryption keys, database, storage, network policy, and support are confirmed with Deixic before installation. |
| Managed deployment architecture and data flow | The application and its data run on Google Cloud Platform, with Cloudflare for DNS, TLS, and traffic proxying; policy decides whether an agent request proceeds, an accepted call reaches the customer-authorized system, and the decision and result stay in activity history. |
| Credentials | Customers bring model keys by default; Deixic monitors managed credential health and supports rotation and revocation; connector profiles and tools scope by team or person, and provider access stays within the permissions granted; policy is evaluated before an upstream credential is resolved, and action records keep a credential reference rather than the secret. |
| Retention, deletion, and residency | Retention is set in the enterprise agreement; at termination the DPA provides for deletion or return of customer personal data, except where law requires retention; residency is confirmed during procurement, and this site publishes no default region. |
| DPA and subprocessors | The DPA covers customer roles, instructions, confidentiality, security, subprocessors, data-subject requests, breach notice, deletion, audits, and international transfers; the subprocessor list states each provider, purpose, and data boundary. |
| Support and incident response | Enterprise support scope and response terms are set in the agreement; security reports go to security@deixic.com and are acknowledged within three business days; the status page carries approved customer-facing incident notices. |
| Security material and SOC 2 | SOC 2 Type II audit work is underway, and the report will be available under confidentiality terms after the audit completes; public material is the Trust page, security policy, DPA, subprocessor list, privacy terms, and status page. |
Security review
Request the current procurement package.
Send the questionnaire, residency requirement, retention requirement, deployment scope, and support requirement to the security team.