Trust center
Deixic changes the settings behind failing controls and security findings in your systems, from GitHub and AWS to Google Workspace, your HR system, and hundreds more. Policy decides before each change runs, a named approver signs off on sensitive ones, and every closed item has a receipt.
You grant Deixic authority by change class. Each change lands in one of three places before it reaches a system.
Low-risk changes to the settings behind a failing control, such as enabling branch protection or deactivating an unused access key. Policy decides before the change runs.
Changes such as removing production admin access. The approver sees the target, the requested change and the evidence, then approves or denies in the queue or in Slack.
Actions the policy does not grant, and decisions only your company can make, such as an access revocation deadline. Deixic does not decide them for you.
Policy applies to calls routed through Deixic. An agent using a tool directly remains subject to that tool's own controls.
Example approval flow
coding-agent · Platform
Deixic reads each setting back after it changes. The receipt and the decision history stay in Deixic, and you export the activity and supporting material selected for a review.
Evidence and activityEach setting Deixic changed and the system it changed in.
Who authorized each change: the policy that allowed it or the named approver.
The value read from the system after each change, so the record shows the setting holds.
Evidence uploaded and tests re-run in the compliance platform where your auditor looks.
Deixic makes changes through the connections you configure, with the permissions you grant at each provider.
A call is evaluated against policy before an upstream credential is resolved. Policy allows the call, denies it or requires approval.
Trace the MCP gatewayAction records point to a credential reference. Secrets stay out of the activity history.
Action record fieldsScope connector profiles and tools by team or person. Calls use the permissions granted at the provider.
Connect toolsConnection health is visible. Rotate or revoke managed credentials from Deixic. Model keys are yours by default.
Credential reviewPrivate Runners get short-lived credentials. A person's own sign-in never lands on the machine.
Set up a Private RunnerPermissions, approval rules and execution history live in Deixic. They do not change when the model or agent behind the work changes.
OIDC SSO, SCIM and roles govern access to configured connections, skills and models.
Enterprise accessScope connector profiles and tools by team or person. Calls use the permissions granted to the connection.
Connect toolsAllow, deny or require a named person's approval before a routed tool call runs. Review the request and supporting material in the queue or Slack.
Approval guideReview agent status, recorded model spend, actions, approvals and results. Export the activity and supporting material selected for a review.
Evidence and activitySee agents waiting on a person. Pause or resume agent activity from Deixic.
Pause an agentA recorded decision explains what was authorized. It does not grant another agent permission or approve the next request.
Review the processing terms and provider responsibilities before connecting company systems.
Read the DPADeixic does not train models on customer content. Access is restricted to people who need it to operate the product.
Data processing addendumDeixic encrypts data in transit. Cloudflare provides DNS, TLS and traffic proxying for the site and application.
SubprocessorsCalls under keys you bring go to your configured provider under your agreement. Calls using Deixic-managed keys route through OpenRouter.
Provider data flowsEnterprise retention is set in the agreement. At termination, the DPA provides for deletion or return of customer personal data, except where law requires retention.
Retention and returnConfirm the required region and deployment architecture with Deixic during procurement.
Procurement reviewReview hosting, execution and operational responsibilities with the team that owns the deployment.
The application and its data run on Google Cloud Platform. Review the infrastructure and provider data flows in the subprocessor list.
Review hosting providersRun Deixic on your Kubernetes cluster. Versioned Helm charts and checksums support architecture review; image access, configuration and support are agreed with Deixic.
Review deployment chartsRun long jobs, coding agents and browser sessions on your own Macs, Linux machines, containers or Kubernetes clusters. Runner placement is separate from where the Deixic application is deployed.
Set up a Private RunnerOpen the public review material or send a questionnaire to our security team.
Processing instructions, confidentiality, breach notice and deletion. Reference text; a signed copy is available by request.
Read DPAProviders, their purpose and the data they process, including the model-provider distinction.
Read SubprocessorsPersonal information collected, its use and the rights available to individuals.
Read PrivacyReport a vulnerability and review the rules for good-faith security research.
Read Security policyCustomer-facing service status and incident notices.
Read Service statusArchitecture, credentials, retention, residency, support and agreement review.
Read ProcurementVulnerability disclosure: security policy and security.txt.
Send your questionnaire, required region, retention requirements and deployment scope to security@deixic.com.