Trust

Security

• Auth — Clerk issues the session. Organization roles are org:admin and org:member. MFA is available on the Clerk account. We do not run a custom identity provider.
• Isolation — Each agent runs in its own Kubernetes namespace with Pod Security Admission restricted and gVisor on new agents. Tenants do not share a process namespace.
• Encryption — TLS on the website (Vercel), API (Cloud Run), and tenant hosts. Google Cloud defaults encrypt disks and databases at rest. Agent and platform secrets live in Secret Manager and are injected into that agent's namespace only.
• Change management — Production ships from GitHub to Cloud Build (API) and Vercel (web). We do not deploy production from a laptop as a shortcut.
• Subprocessors — Google Cloud (hosting), Vercel (web), Clerk (auth), Stripe (payments), Resend (transactional email), plus PostHog and Sentry for product analytics and frontend errors. Customer model keys are bring-your-own. We do not call a foundation model on your content unless you configure that provider.

Cloud and regions

SEAOTTER is hosted on Google Cloud. Today the control plane (API + database) and agent data plane both run in us-central1 (Iowa). Additional GCP regions (South Carolina, Belgium, Singapore) are Coming soon. When live, agents will pin to the region you choose at create. There is no automated cross-region failover for the control plane or for an individual agent.

A regional outage in us-central1 takes down the product control plane and agent management for everyone until that region recovers.

What backups cover

• Control plane database — Cloud SQL automated backups and point-in-time recovery in us-central1. The database is zonal. There is no cross-region replica yet.
• Your agent data — Same-region PVC snapshots as the agent's cluster. Typical recovery point objectives: up to 6 hours for per-agent plans, or up to 1 hour (Custom / Enterprise). In-region restore is usually minutes when the cluster is healthy. That is an operational expectation, not a published RTO SLA.

What we are not claiming

• SOC 2, ISO 27001, or any other compliance certification
• Active-active multi-region hosting for a single agent
• Automated failover of the control plane out of us-central1
• That Enterprise pricing includes a regional uptime or DR SLA

Enterprise means custom quotas, SSO, and support, not active-active HA. When more regions ship, choosing one places your agent. It does not multiply the control plane.

Near-term improvement

By 31 Oct 2026 we intend to add a Cloud SQL cross-region read replica (us-east1) that can be promoted, plus a tested manual runbook for control-plane recovery. Expected recovery time for that path is hours (roughly 4–24), not minutes, and it is not a customer SLA until we measure and productize it.