Let agents work. Keep control of their reach.
oz0 checks access, actions and budgets outside the model. You choose the machines, people, plugins and services it can use.
Illustrative examples with rules you could configure. No real tools are called.
The agent proposes
“Delete a customer record.”
The boundary
Your rule refuses deletion.
Tool call blocked
The delete tool is not called, even if the model asks for it.
Your part: You decide which tools are available and which actions to refuse.
What oz0 handles. What you handle.
oz0 provides the controls below. Your team configures and operates them.
| Area | oz0 provides | Your team handles |
|---|---|---|
| Actions | Checks oz0 tool calls against your rules. | Choose allowed actions and who approves sensitive ones. |
| Access | Separate permissions for running jobs and reading their content. | Grant people and apps only the access they need. |
| Secrets | Keeps model-provider keys on the server; encrypts stored job payloads in a cluster. | Secure your servers and keep recovery keys with tested backups. |
| Machines | Supported sandboxes restrict file and network access. | Choose suitable isolation and trusted plugins. |
| Spending | Strict reservation checks model-call costs before sending. | Set budgets and enable strict reservation to prevent overshoot. |
Where can your data go?
The models and tools you choose determine what leaves your machines. You decide what data they may receive and how long to keep job records.
Your oz0 server
Sends model requests
Your model provider
Receives prompts and context. A local model can keep this path on your hardware.
Your worker machine
Runs the configured tools
Your connected systems
Receive tool requests, such as a log search or ticket update.
oz0 sends no telemetry, usage statistics or crash reports to us. Plugin installs and refreshes can contact the Hub or package registries.
Know the boundaries before you run it.
- Not every action goes through oz0
- Built-in actions in some external coding tools bypass oz0 tool-call checks. Stopping work cannot undo an action already completed.
- Isolation depends on the machine
- Tier 0 means no sandbox. Plugins are trusted code; without a plugin sandbox, they run with the node user’s rights. Check the limits for your operating system.
- Protect the server and its keys
- The server component that handles requests, called the edge, holds powerful cluster keys. If it is compromised, the cluster is at risk.
- Review what the agent produces
- A permitted action or plausible answer can still be harmful or wrong. Test your workflows and review consequential changes.
Check what you install.
Signed releases come with a list of software components and build records. Verify the signature before installing.
Reviewing oz0 for your organisation? Public access to the trust pack is coming soon. Contact us with review questions.
Trust packComing soonReviews and certifications
Status reviewed 27 October 2026
No independent security audit or certification has been completed yet. These are our plans; there are no confirmed completion dates.
Independent security test
Planned · not completed
An external penetration test of oz0. The testing firm and date are still to be confirmed.
ISO/IEC 27001
First certification goal · not certified
Information security management for how we develop, release and support oz0.
ISO/IEC 42001
Next certification goal · not certified
AI management: how we govern the risks and responsibilities of developing and using AI.
SOC 2 Type II
Under consideration · no report
An examination of controls over time, considered if customer needs justify it. It is not currently scheduled.
The ISO goals concern our organisation’s management practices. A future certificate would have a defined scope; it would not certify every deployment of oz0.
European rules: NIS2, GDPR, EU AI Act, CRA and DORA
These laws are separate from voluntary certifications. Your obligations depend on what you run, where you operate and your role. Using oz0 alone does not make an organisation compliant.
- NIS2Cybersecurity duties for organisations in covered sectors, through national law.
- Scope must be assessed for each organisation. oz0 does not provide a NIS2 certificate.
- GDPRResponsibilities when processing personal data.
- Access and retention controls help you operate oz0. You still determine lawful use, data sharing and your controller or processor responsibilities.
- EU AI ActDuties that depend on your role, the AI system and its use.
- Assess your use case and risk category. Running an agent in oz0 does not establish conformity.
- Cyber Resilience ActProduct security and vulnerability-handling requirements for covered digital products.
- Our applicability and readiness review is pending. We do not claim CRA conformity or CE marking for oz0.
- DORADigital resilience and technology supplier requirements for covered financial entities.
- Financial-sector users need their own supplier and deployment assessment. oz0 is not a DORA certification.
Each name links to official guidance. oz0's controls and limitations are summarized above and detailed in the public Docs preview. Public trust-pack access is coming soon.
Found a vulnerability?
Report it privately by email. We confirm receipt within three working days. Please keep vulnerability details out of public issues.