What we can promise, and what we can't

OpenLegion runs agents that read your data and act on your behalf. Below is what the product actually enforces today, written plainly enough that you can hold us to it — and, at the end, the things we are not claiming.

Last reviewed: September 2026

Eight things that are true today

Every tool call is checked before it runs

Every tool call is an intent, policy-checked before execution, with a receipt the owner can read.

Secrets stay in a vault

Secrets live in a vault; brokered credentials are injected outside the model, which sees a handle.

Code runs in a sealed sandbox

Code runs in a Firecracker microVM sandbox on a lease that ends when the task does.

Untrusted content can't act on its own

Content that arrives from outside your workspace is marked untrusted, and cannot trigger a send, a delete or a change to an agent without your approval card.

One workspace can never read another

Tenant isolation is row-level security on every table, verified by a cross-tenant test suite in CI.

Only a human approves

Approvals are asynchronous rows decided only by a workspace owner or admin; an agent cannot approve itself.

Every inbound message is verified

Stripe, Slack, Telegram and generic webhooks are signature-verified; production refuses to boot without its secrets.

Your conversations are not training data

Model traffic on our platform keys is zero-retention and opted out of training.

Where work stops for you

Three walls, and only three, so that a card still means something when one appears: reaching a third party on your behalf, deleting data, and acting on content that arrived from outside your workspace. Everything else runs and leaves a receipt you can read afterwards. Decisions are made in the app, by a workspace owner or admin — never by an agent, and never by us; your channels can tell you a card is waiting.

Your data

You can erase your workspace from Settings at any time; erasing removes your workspace's rows and the files stored with them. The workspace owner can export its data on every plan, and on Team and above the export includes the activity log. Conversation history is kept until you delete it or erase the workspace. We do not sell personal information and we do not train models on your data.

What we don't claim

We hold no SOC 2, ISO 27001 or HIPAA certification, and we don't describe the product as "GDPR compliant" or "EU AI Act compliant" — compliance is a property of how you use a system, not a badge a vendor awards itself. No system that reads the open web is immune to prompt injection; we publish no attack-success percentages, because a number without a published method is marketing. Web search and page fetches run on our servers, not inside the code sandbox, so "fully sandboxed" would be wrong. We have not commissioned a third-party penetration test. When any of that changes, this page changes with it.

Reporting a problem

Found something we should know about? Email support@openlegion.ai and we will answer.

Join the waitlist to see the approval cards for yourself.

Join the waitlist →