Security and data handling
The full statement for enterprise review is on the security page. This is the engineering summary.
What crosses the boundary
Section titled “What crosses the boundary”| Journey turns sent to the agent | in |
| Agent responses | out |
| Spans from your trace backend | out |
| Read-only verification calls | opt-in, interface you define |
| Agent source code | never |
| Model weights or prompts | never |
| Production customer data | not required |
Deployment
Section titled “Deployment”| Option | Status |
|---|---|
| Local / self-hosted runner | Available |
| CI runner in your own pipeline | Available |
| Customer VPC deployment | Roadmap |
| Hosted multi-tenant SaaS | Not offered |
DialogAssert holds no security certification today. We do not claim SOC 2, ISO 27001 or HIPAA and will not until an audit has been completed.
Data minimisation
Section titled “Data minimisation”Journeys run against test identities and seeded fixtures. Trace payloads are decoded only to the depth a control requires. Evidence a control does not need is not retained in the report, and exported reports are projected onto an explicit schema rather than dumping raw runner output.
Judging
Section titled “Judging”Controls that can be settled deterministically involve no model call at all — ordering, arguments, entity identity and observable state are decided by the evidence. Where a control genuinely requires interpretation, a semantic evaluation runs and the finding records that it was judged. The judging model is configurable, and a deterministic-only mode operates with no external model call.
Human decision boundary
Section titled “Human decision boundary”DialogAssert produces findings and evidence. It does not autonomously certify an agent as lawful or compliant. Whether the evidence is sufficient for a release and for your regulatory controls is your organisation’s judgement to make.