Privacy & security
Private by design. Yours by default.
Businesses will rely on the coworkers we build. So we build them to run on your terms, enforce security in the system rather than in a prompt, and never hold your processes, data, or intellectual property hostage.
Four things we won’t compromise on.
It runs where you choose
Your cloud tenant, your server room, or a fully air-gapped network. The coworker’s workstation, memory, retrieval, and models can all live on hardware you own.
Your data never trains a model
We default to open-weight models served on your GPUs or by providers with strict zero-data-retention terms. We only use a proprietary model when its provider guarantees ZDR and the job truly needs it.
Locked down by default
Coworkers can reach only what a rule explicitly allows, do only what their role grants, and must ask before anything consequential.
Nothing held hostage
Your coworkers’ skills, memory, connectors, and configuration belong to you, in portable formats. Run them yourself, move them, or leave. Your processes are your IP.
Ten layers between a coworker and a bad day.
| Layer | Control | What it stops |
|---|---|---|
| 01Network | Deny-first firewall per coworker. Each rule names the program, host, port, and HTTP method and path allowed. | Data exfiltration, surprise destinations, lateral movement |
| 02Workstation | Isolated sandbox per coworker and customer. Root-owned, fingerprinted configuration. No admin rights. | A coworker rewriting its own rules or reaching another tenant |
| 03Commands | Shell commands parsed as full programs, then allowed, denied, or sent for approval, with an audit log. | Destructive or unexpected commands |
| 04Applications | Role-scoped connectors. Tools outside the role don’t exist for the coworker, and the server rejects them. | Over-broad access, prompt-driven privilege creep |
| 05Credentials | Secrets held in a broker or service outside the workstation. The coworker gets a scoped key. | Credential theft from the agent’s environment |
| 06Writes | Dry run, perform once, read back. Idempotent operation IDs prevent double sends. | Silent failures, duplicates, “it said it worked” |
| 07Email | Explicit reply-or-stay-silent decision, external sending off by default, optional outbound review for secrets and personal data. | Oversharing, reply-all accidents, noisy agents |
| 08People | Approval cards tied to the exact plan version, decided only by verified members of the chat. | Unapproved changes, approval by the wrong person |
| 09Operations | Single sign-on, viewer/operator/admin roles per customer, a full audit log, and redacted secrets. | Untracked changes, operator overreach |
| 10Recovery | Snapshots every five minutes, full backups, point-in-time restore, clone, and move between hosts. | Lost work, bad changes, hardware failure |
01Network
Deny-first firewall per coworker. Each rule names the program, host, port, and HTTP method and path allowed.
StopsData exfiltration, surprise destinations, lateral movement
02Workstation
Isolated sandbox per coworker and customer. Root-owned, fingerprinted configuration. No admin rights.
StopsA coworker rewriting its own rules or reaching another tenant
03Commands
Shell commands parsed as full programs, then allowed, denied, or sent for approval, with an audit log.
StopsDestructive or unexpected commands
04Applications
Role-scoped connectors. Tools outside the role don’t exist for the coworker, and the server rejects them.
StopsOver-broad access, prompt-driven privilege creep
05Credentials
Secrets held in a broker or service outside the workstation. The coworker gets a scoped key.
StopsCredential theft from the agent’s environment
06Writes
Dry run, perform once, read back. Idempotent operation IDs prevent double sends.
StopsSilent failures, duplicates, “it said it worked”
07Email
Explicit reply-or-stay-silent decision, external sending off by default, optional outbound review for secrets and personal data.
StopsOversharing, reply-all accidents, noisy agents
08People
Approval cards tied to the exact plan version, decided only by verified members of the chat.
StopsUnapproved changes, approval by the wrong person
09Operations
Single sign-on, viewer/operator/admin roles per customer, a full audit log, and redacted secrets.
StopsUntracked changes, operator overreach
10Recovery
Snapshots every five minutes, full backups, point-in-time restore, clone, and move between hosts.
StopsLost work, bad changes, hardware failure
Everything we build for you is yours.
We know businesses come to depend on these systems. Holding your processes hostage would be bad engineering and bad faith. When the engagement ends, you leave with:
- Skills: the written procedures your coworkers follow
- Memory: what they’ve learned about your customers and work
- Connectors and the configuration that scopes them
- Transcripts, logs, and audit history
- Backups in documented, portable formats
What we won’t claim.
No certifications we don’t hold
QRK Tech isn’t SOC 2, HIPAA, or CMMC certified today. We design deployments to fit your compliance program, and we’re glad to work through your security questionnaire.
AI review isn’t DLP
Our optional outbound email review catches secrets and sensitive data, but it’s probabilistic. It supplements your data-loss controls and doesn’t replace them.
Models make mistakes
That’s why consequential actions need approval, every write is read back, and the coworker’s permissions are cut to the job, so a mistake stays small and visible.
Security questions, answered.
Where does our data go?
Wherever you decide. A coworker’s workstation, memory, and models can all live inside your environment. When we use hosted models, we choose providers with zero-data-retention terms, and your data is never used for training.
Can the AI access systems it shouldn’t?
Not without a rule allowing it. Network access is denied by default and allowed per program, host, port, and path. Application access is scoped by role on the server side. A coworker can’t grant itself either.
What stops it from doing something destructive?
Layers. Destructive tools usually aren’t granted at all. Consequential actions need approval, shell commands are checked against a policy, and every change is dry-run first and read back after.
What about prompt injection in emails or tickets?
Content from tickets, emails, and documents is treated as untrusted evidence, never as instructions. More importantly, even a fooled coworker is still confined by the same role, network, and approval controls.
Is there an audit trail?
Yes. Sessions, tool calls, approvals, command decisions, firewall denials, configuration changes, and control-plane actions are all recorded.
Are you SOC 2, HIPAA, or CMMC certified?
QRK Tech doesn’t hold those certifications today, and we won’t pretend otherwise. We design deployments to fit your compliance program, including fully private and air-gap-capable setups, and we’re glad to work through your security questionnaire.
Next step
Bring your toughest security questions.
We’d rather talk through your requirements early than surprise you later. Email hello@qrktech.com or start a conversation, and we’ll walk through how a deployment would fit your environment.