Security
How the platform is built to fail safely: isolation per agent, credentials that never reach a model, an approval gate the model cannot move, and a log of everything.
DRAFT · NOT LEGAL ADVICE
This document records how Zuger intends to operate and is published so you can read it before you sign up. It is a working draft pending review by counsel in each of our three jurisdictions, and it is not legal advice to you. The executed version you receive at signup is the one that governs. Last updated 13 September 2026.
The threat we design against
The interesting failure is not a leaked database. It is an agent doing something plausible and wrong with real consequences — because a web page told it to, or because it inferred a permission it did not have. Two structural choices make that outcome boring: agents prepare but never file, sign or pay, and bank access is read-only. There is no code path from a bad inference to a transfer.
Isolation
Isolation is at the data and credential layer, not the machine layer: an agent can reach only the connections its mandate names, scoped per company and per entity, enforced in the query layer rather than by prompt. There are no per-agent virtual machines and no browser automation — see the limits below.
Credentials
Scoped OAuth tokens, encrypted at rest with per-tenant keys, decrypted only inside the worker that uses them. They never enter a prompt, never appear in a transcript, never reach a subprocessor and are never returned to a browser. Revocation takes effect mid-run and is done at the provider, not just locally. We never hold your bank credentials — transaction data arrives read-only through a licensed open-banking provider.
Prompt injection
Content an agent reads — a web page, an email, a PDF, a form — is data, never instruction. Mandates and thresholds change only through an authenticated human action outside the run. An instruction found in content that tries to change either is logged and surfaced to you as an attempt.
The approval gate
Enforced in the platform, not in the model. Money out, filings, contracts and outbound communication stop and wait. An agent cannot raise its own threshold, approve its own request, or ask another agent to approve it. Approval requires a human session token; a machine token can read the queue and nothing more.
Audit
Append-only, per company: every page opened, field typed, file touched and decision taken, with the reasoning and the run id. Exportable in full. Zuger staff access requires a ticket from you, is time-boxed, and appears in your log like anything else.
Access control
Least privilege, named approval, hardware-key MFA for everyone on the team, and no standing production access. Every elevation is time-boxed and recorded.
Testing
Annual third-party penetration test covering the platform and the agent sandbox, with the report available under NDA. Dependency and advisory scanning runs continuously; Gotthard opens the fix PRs on our own repositories too.
Resilience
Encrypted backups with a documented restore procedure, tested quarterly. Runs are resumable: an interrupted run reports or resumes, and never half-commits an action against a registry.
What we do not build
No per-agent virtual machines, no browser automation, no stored third-party logins, no payment initiation. If a capability would require driving a website with your password, it is out of scope — permanently, not until version two.
Reporting a vulnerability
Write to security@zuger.ai. Acknowledged within one working day, triaged within three, and you will hear the outcome. We do not take legal action against good-faith research, and we will credit you if you want us to.
Questions about this?
Write to privacy@zuger.ai for anything on this page. A person answers, not a portal.