Security at Rallied
Rallied is an AI agent that resolves IT support tickets inside your own tooling, which means it holds privileged access to your clients' systems. This page describes the controls that govern that access, the infrastructure it runs on, and where our compliance program currently stands. It describes what is in place today, not what is planned.
1. How the agent is constrained #
The question we get asked first is what stops the agent doing something it shouldn't. Four mechanisms, all enforced in the product rather than by policy.
Every tool carries an explicit policy
Each action the agent can take is a named tool, and every tool is set to one of three states: run automatically, require approval, or disabled. There is no implicit permission. A tool that has not been enabled cannot be invoked, and you set these policies per deployment rather than accepting a default.
Privileged actions wait for a human
When a tool is set to require approval, the agent stops and asks. The action is held until a technician approves it, and it does not execute in the meantime. Tools can additionally require a manager's approval, so higher-risk actions need a second, more senior person rather than whoever is on shift.
Plan Mode is read-only
Plan Mode runs the agent with execution disabled entirely. It reads context, diagnoses the problem, and writes up what it would do — and it cannot act on any of it. This is how most teams start: let it work a few hundred tickets in read-only, read the plans it produces, and enable execution one tool at a time once you agree with its judgment.
Every execution is logged
Each tool execution writes an immutable audit record: which client it was for, which tool ran, and what the outcome was. The log is append-only, so it is a record you can hand to your own auditor rather than a dashboard we can quietly rewrite.
2. Infrastructure security #
- No public inbound to agent hosts. Agent and sidecar administrative ports are not reachable from the internet.
- Firewalls on every host. All 13 production and staging hosts are attached to a cloud firewall. No host runs unprotected.
- Private networks, split by environment. Workloads run inside private VPCs, with production and staging on separate networks.
- Egress proxies cannot reach back in. Outbound traffic routes through dedicated egress proxies that are explicitly denied network access into the VPC, so a compromised proxy cannot reach agents, sidecars, or the database.
3. Encryption #
- In transit. Traffic is encrypted with TLS, including database and cache connections, with certificate chain verification enabled.
- Integration credentials. Integration credentials and OAuth tokens are encrypted at the field level before they are written to the database.
- At rest. Managed Postgres and Redis are encrypted at rest by the platform provider.
4. Access control and personnel #
- Background checks are performed on new employees.
- Employees complete security awareness training at hire and annually after that.
- Employees and contractors sign confidentiality agreements.
- Access is revoked on termination through a documented checklist.
- Information security policies are documented and reviewed at least annually.
- Production changes are reviewed and approved before they deploy.
- A documented incident response plan is in place.
- Cybersecurity insurance is maintained.
5. Compliance #
Rallied is currently pursuing SOC 2 Type II certification. Our security program is managed and continuously monitored in Vanta. We are happy to share our current control status under NDA.
We are not yet certified, and we will not describe ourselves as certified, compliant, or attested until we hold the report. If your questionnaire needs a control-by-control answer before then, ask and we will walk through our current status with you directly.
6. Subprocessors #
Resolving a ticket means sending its contents to third-party AI providers, and ticket content can include end-user names and email addresses. The providers we use:
| Subprocessor | Purpose | Region |
|---|---|---|
| Anthropic | Model inference | United States |
| OpenAI | Embeddings | United States |
| Pinecone | Vector storage | United States |
| DigitalOcean | Hosting and managed datastores | United States |
Customer data and model training
Customer data sent to our AI providers is not used to train their models. We use these providers under commercial agreements that exclude API inputs and outputs from model training.
7. Report a vulnerability #
Email security@rallied.ai. Include enough detail to reproduce the issue. We acknowledge reports within two business days and will tell you what we intend to do about it and roughly when.
We do not pursue legal action against researchers who report in good faith: test only against your own account or data, do not access or modify other customers' data, do not degrade the service, and give us reasonable time to fix the issue before disclosing it publicly.
Questions #
For a security questionnaire, our current control status, or our DPA, email security@rallied.ai or use the contact form. Our Data Processing Agreement covers processing terms, subprocessor obligations, and international transfers.