Security and data handling
We agree the data boundary, the access, and the people who approve before an agent or an operator touches your systems.
Define the data boundary
The engagement records which data the agents need, where processing happens, which systems they may read and write, and who authorizes access.
Permission levels
Every agent works at a written permission level. Operators run the agents inside those levels; your named approver decides anything beyond them.
| Level | What the agent may do | Who approves |
|---|---|---|
| Read | The agent reads the sources it was granted, and nothing else. | The access is approved once, when the system is scoped. |
| Draft | The agent prepares work, and a person decides whether it is used or sent. | An Ergon operator or someone on your team reviews each draft before it leaves the system. |
| Pre-authorized routine write | The agent makes a bounded, reversible change that a written policy already allows. Every change is logged. | A named owner on your team approves the policy in advance. Operators watch the changes, and anything outside the policy waits for a person. |
| Consequential action | Payments, commitments to customers, changes to a record of truth outside an approved policy, and anything that cannot be undone. | A named person approves each one, every time. If nobody approves, nothing happens. |
| Release | A new model, agent, prompt, or rule version goes live. | The client’s named approver approves each release after the agreed tests pass. Contractual acceptance of the work is a separate step. |
Access and approval
- Identify the systems and data the role needs.
- Grant access per system, at the lowest permission that does the job.
- Name the approver for consequential actions and releases.
- Agree operator coverage, escalation contacts, and incident contacts.
- Agree retention, deletion, and handover terms.
Website information handling
The Privacy page explains website forms, browser storage, and the providers that process requests. The site loads no advertising or tracking scripts of its own. Cloudflare Web Analytics, run by our host, measures page views and load times in aggregate.
AI-use policy
How Ergon uses AI tools on client work. Each engagement's scope records the details.
- The AI tools and models used on your work are named in the engagement scope, with the data each one may see. Their data terms are shared with you before use.
- Your data is used only for the engagement you shared it for.
- Your data is not used to train models for other clients or for Ergon’s or Sophrono’s own products.
- Operators see your data only inside the systems and permissions you granted.
- Every correction and run record stays with your engagement, and becomes your test set.
- Your named approver decides consequential actions and every release.