Built-In Security
SmythOS is designed with data isolation and zero-trust at its core.
Enterprise-Grade Security, Built In
Secure Agents, From Vault to Execution

Our Security Approach
Like code frameworks, SmythOS gives developers ultimate control over agents while enforcing best practices.

Runtime Advantage
Our runtime is lightweight, modular, and auditable โ deployable on edge, cloud, or on-prem.

Subsystems & Connectors
Isolation โ strict access boundaries Flexibility โ local or remote backends Extensibility โ easy integration of secure components.

Zero-Trust Architecture
Enforcing least privilege and access controls across all components.
Principle of least privilege
Every component and agent operates under the principle of least privilege. There is No implicit trust between components.
Fine-grained ACLs
All interactions are secured with an internal ACL/Candidate system in order to enforce which agents, modules, and users can access specific resources.
Secure Storage & Data Isolation
Protecting data through flexible backends and strict tenant separation.
Support for On-Premise & On-Device
Deploy SmythOS within your own infrastructure. Data flows stay local, never leaving your environment unless you choose a remote backend.
Flexible Data Storage Options
Choose the backend that fits your needsโlocal disk/RAM for isolation or secure remote storage like S3 and Redis with enterprise-grade encryption.
Strict Tenant & Agent Isolation
Each tenant and agent runs in a fully isolated context. Connectors are restricted by design, ensuring data never crosses boundaries.


Secrets & Key Management
Vault-based storage and extensible connectors for sensitive data.
No secrets in code
API keys, credentials, and tokens are never hardcoded or stored in application code or agent data.
Policy inheritance
Secrets management is delegated to the configured vault connector, ensuring that the customerโs existing security policies, access controls, and audit trails apply by default.
Extensible design
Custom connectors can be implemented to integrate with other enterprise vault or key management solutions.
Vault-based storage
SmythOS provides secure connectors for managing sensitive data via industry-standard vault systems. Supported integrations include HashiCorp Vault and AWS Secrets Manager.


LLM Security & Deployment Options
Safe integration with public, enterprise, and local LLMs.
Public API Models
Supports LLMs accessible via API (e.g., OpenAI, Google Gemini, Groq, Perplexity). Data sent to these services is transmitted over TLS-encrypted connections, and the handling of that data is governed by the providerโs security and privacy policies.

Hosted Enterprise LLMs
Integrates with cloud-hosted enterprise services such as Google Vertex AI and AWS Bedrock, enabling customers to leverage managed LLM infrastructure while maintaining control over data residency and provider-level compliance.

Local / Self-Hosted Models
SmythOS can run against local LLM deployments (on-premises or in a private cloud). This ensures that all data remains within the customerโs environment, providing maximum control for regulated or sensitive workloads.

Sandboxed Execution
Isolated environments for running custom and untrusted code.
Node.js Execution
Executes inside an AWS Lambda function (or equivalent isolated runtime), providing process-level isolation and resource controls.


JavaScript / ECMAScript Execution
Runs in a fully sandboxed environment with no access to Node.js packages or browser APIs.
Configurable Security
Components can be disabled by or completely removed from the bundles in order to make them unavailable to agents.โจ
Observability & Auditability
Comprehensive logging, monitoring, and redaction for transparency.
Full audit logs
Logs of agent activity, execution flows, and access decisions is available through SRE logging interface, the logs can be set to a high verbose level, or to specifically track some components.


Real-time logging and Monitoring
Provide transparency for debugging, security incident response, and usage tracking of third-party providers, such as LLM tokens, etc.


Logs aggregation and redaction
Logs can be aggregated into enterprise SIEM systems for analysis, auditing, alerting.Logs can be partially redacted based on certain patterns and regular expressions.The example below shows an example of automatic redaction of authentication token.


Data Protection & Encryption
Strong encryption for data in transit and at rest across deployments.
In SmythOS SaaS
Data-in-transit is encrypted using TLS 1.2+ to protect communications between clients, agents, and services.
Data-at-rest is encrypted using the cloud providerโs Key Management Service (KMS). Keys are rotated and managed according to provider best practices.


On-Premise Deployments
On-premise deployments can use custom components to leverage host platform capabilities, providing fine-grained control over encryption and key management.
SmythOS already supports custom connectors for third-party Key Management Systems (KMS), including HashiCorp Vault, AWS KMS, and Azure Key Vault.
Deployments can potentially integrate with hardware-based security modules (TPM / HSM) for secure key storage and stronger cryptographic assurance by implementing custom connectors.
Deployment Flexibility for Security Requirements
Protecting data through flexible backends and strict tenant separation.
Cloud (SmythOS SaaS)
Multi-tenant deployment with strict per-tenant isolation. Customer data and agent workloads are logically segregated, ensuring confidentiality and integrity.
On-Premises / VPC
Deployable inside the customerโs own infrastructure (data center or cloud VPC). Guarantees that data never leaves the customerโs environment and enables alignment with internal compliance, residency, and monitoring policies.
On-Device
Lightweight deployment where single or multiple agents are bundled with the Smyth Runtime Environment (SRE) into a standalone executable (.exe). Ideal for highly controlled or offline environments requiring local execution only.


Developers Love SmythOS
Join over 20,000 developers who build with Weaver.