Security at KutrimBots

Every workspace (your team of agents) runs in its own isolated environment, with its own files, memory, keys and agent process. Every request is checked against your session and limited to your own workspace, so one customer can never reach another's data.

Agents don't run commands or code on KutrimBots' servers. If you want an agent to run commands, you connect your own server in the Security Vault, and commands run only there.

Sending email or messages, posting publicly, paying, deleting and changing things in connected apps produce an approval card first, unless you choose to allow them. Approvals that aren't answered expire instead of running.

Keys and passwords you store are encrypted at rest (AES-256-GCM) and shown only as their last few characters. Connected apps use OAuth through Composio, so agents never see your app passwords.

Each agent keeps a private memory. Super Brain, the team memory, can be turned off per agent; every note records who wrote it, notes from other agents are treated as information rather than instructions, and entries that look like instruction injection or credentials are left out.

Passwords are hashed, and sessions use secure, HTTP-only, SameSite cookies. All traffic is encrypted with HTTPS.

Email support@kutrimbots.com. We reply within 1 business day and keep you updated until it's fixed.