Security. What agents can touch, and what they can't.
An agent with access to production should have to earn every write. Everything below is how the product actually behaves.
Read-only until you say otherwise. Even then, every write is screened.
Read-only by default
New cloud accounts connect read-only. Write calls are refused until you turn read-only off, per account.
A safety review even after you opt in
Even with read-only off, every call that changes something still goes through a safety review.
Code changes go through review
Code fixes go to your repos for review. Praxen Inc. merges only where you enable it.
Coding-agent writes are double-gated
Over MCP and the CLI, write tools need the agent_tools:write scope and a per-session opt-in header. Every write is then screened by a safety model.
Least privilege, end to end. No key can do more than the job needs.
Connections ask for the minimum
AWS through a scoped CloudFormation role, Cloudflare with pre-filled token permissions, GitHub and Sentry as apps. No provider gets a god-mode key.
Credentials are sealed
Credentials are encrypted before they're stored, and agents never see them: every tool call goes through Praxen Inc.
API keys are scoped and revocable
Each key belongs to one workspace, has an explicit list of scopes and is shown once. Delete it and the next request fails with a 401.
OAuth done properly
Sign-in uses the authorization code flow with PKCE, access tokens last an hour, refresh tokens work once, and revocation is immediate.
Roles for people too
Every workspace has owner, admin, member and read-only roles, and admin-only actions stay admin-only through the API.
Sandbox secrets are encrypted
Secrets for your repository's environment are encrypted before they're stored.
Every answer shows its evidence. If Praxen Inc. can't back up a conclusion, it doesn't count.
Claims link to evidence
Answers link back to the query, log line or change behind them. Tool results stay in the transcript.
"Confirmed" requires data
No evidence means an inconclusive verdict, and an investigation that couldn't reach the data never confirms anything.
Full transcripts, kept
Investigations and fixes run as threads you can watch live, interrupt, and audit after the fact.
Detection leaves an audit trail
Every check is recorded, and every metric keeps the exact query behind it.
Nothing runs without limits. Praxen Inc. caps its actions, its spend and its calls to your providers.
A floor you set
Set a minimum severity, and confirmed issues below it wait for a person to start the investigation. You still get the verdict; only the work after it waits.
Spend caps
Praxen Inc. pauses at your plan's limits, with warnings at 70% and 90%. Overage is opt-in and stops at a cap you set.
Your providers' rate limits, respected
Praxen Inc. budgets its calls to each provider's API and backs off when the budget runs out.
Your infrastructure, on your terms. You decide what gets shared, and old change history ages out.
Nothing public by accident
Threads stay inside your workspace. Public sharing is a separate, deliberate step.
Public pages are scrubbed
Public reports strip account, region and connection identifiers. A shared graph shows display names only.
Finite retention
Praxen Inc. keeps change history for 30 days or the most recent 5,000 changes per account, and the 50 most recent reports per connection.
Bring your own model
Use your own LLM provider key, and inference runs under your agreement with that provider. getpraxen.app/pricing shows which plans include it, and the AI gateway for self-hosted models.
Found a vulnerability? Email security@getpraxen.app. It goes straight to the founder; we respond within two business days. Third parties that process customer data are listed at /subprocessors.