Security & Trust
Here's exactly how it works — not a badge, the actual architecture. Formal third-party certifications are in progress; here's what's already true today.
How does Akili handle security?
Akili logs every mutating action to an org-scoped audit trail on every tier, encrypts provider credentials at rest at the database layer, and enforces deny-by-default RBAC on the server with read and write separately grantable per resource. Tenant isolation is resolved from the verified token on each request rather than filtered afterwards. SSO over SAML/OIDC uses DNS-verified domains, and SCIM handles deprovisioning today — auto-provisioning is still in progress. Akili does not train models on customer data, and holds no SOC 2 or ISO certification yet; the architecture below is published in place of a badge.
Security architecture
Audit trail
Every mutating action is logged automatically, org-scoped, and reviewable — no per-endpoint instrumentation required to catch a change.
Encryption for credentials
API keys, provider credentials, and MCP server secrets are encrypted at rest at the database layer, not stored in plaintext anywhere in the platform.
Role-based access control
Permissions are enforced down to individual actions on the server — read and write are separately grantable on every resource, not a UI-only convenience.
SSO, SAML & OIDC
Bring your identity provider. Org membership provisioning is opt-in per organization by design, not an automatic join on first login.
Access removed automatically when someone leaves
Deprovisioning runs over SCIM: when your identity provider disables an account, that person's Akili access goes with it. Auto-provisioning new users via SCIM is on our roadmap — today, invites are explicit.
SCIM handles deprovisioning today; auto-provisioning is in progress.
Self-hosted, if you need it
Run the full platform — chat, agents, knowledge, memory, integrations — inside your own infrastructure. The public marketplace and org billing plane are cloud-only.
Certifications
In progress — said plainly
We don't have a SOC 2 or ISO badge to show you yet. Rather than a badge-shaped graphic for something we haven't completed, the real architecture above is reviewable today — no wait required.
FAQ
Security questions, answered directly
Including the ones where the honest answer is “not yet”.
Not yet. Formal third-party certifications are in progress, and rather than show a badge-shaped graphic for something incomplete, the actual architecture is published for review today — audit trail, encryption, RBAC, tenant isolation, and identity, caveats included.
No. Akili does not train models on customer data. When you bring your own provider key, model usage bills directly to your provider account and those calls are governed by your agreement with that provider.
Tenant scope is resolved from the verified token on every request and enforced in the data layer, not filtered as an afterthought. Your personal workspace is a tenant of one, and joining an organization adds a membership rather than a second account.
Every mutating action is logged automatically, org-scoped and reviewable, with no per-endpoint instrumentation required to catch a change. Audit logging is on for every tier; immutable audit logs are a Business and Enterprise entitlement.
Encrypted at rest at the database layer. They are not stored in plaintext anywhere in the platform, and that applies to integration and MCP connector credentials as well.
Yes — SSO over SAML/OIDC with DNS-verified domains, on Business and Enterprise plans. SCIM handles deprovisioning today; auto-provisioning is in progress rather than shipped. Organization membership provisioning is opt-in per organization by design, not an automatic join on first login.
Permissions are enforced down to individual actions on the server, with read and write separately grantable on every resource — deny-by-default, and not a UI-only convenience.
Then self-hosted is the answer: the full platform inside your own network boundary, with your PostgreSQL, your blob storage, and your keys — and an Ollama stack where even inference never leaves the building. Self-hosted deployments are coming soon and start with a conversation about your environment.
Agents with code execution enabled run in an isolated sandbox, not in the platform's own process. In Kubernetes deployments that sandbox is a separate, isolated workload.
Bring your security review.
The honest answers about what's included, what's cloud-only, and what's on the roadmap are the first thing we'll walk through.