Security & Privacy

Questions we get from security teams.

oNabu is an AI execution intelligence platform. Before any enterprise deploys AI into their engineering workflows, their security team asks the right questions. Here are the answers.

Data & Residency

Identity & Access

Write Guardrails

Monitoring & Audit

Breach & SLA

Compliance

Full documentation, certifications, and control status

↗ trust.onabu.ai

Questions we get from security teams.

Data & Residency

Where does our data reside? Can it stay within our own cloud environment?

What data does oNabu actually read? Does it access private messages or employee communications?

Is our data used to train AI models?

What happens to our data during a read-only POC?

What is oNabu's approach to data masking before sending data to LLMs?

How is data encrypted?

Identity & Access

How does oNabu authenticate to our systems? Can we guarantee the agent is the only one using its credentials?

We already run Microsoft Copilot and other agents. How does oNabu's identity stay separate?

Who at oNabu can access our production data?

Write Guardrails

What write operations can oNabu actually perform? How do we know it won't do something unexpected?

Can the agent execute writes on its own, or does a human always approve?

What does the write-action pipeline look like end to end?

Do you have production evidence that the guardrails work?

Monitoring & Audit

Can our security team see what oNabu has done — without asking oNabu for it?

How long are logs retained?

What vulnerability management and penetration testing do you conduct?

Breach & SLA

If oNabu were compromised, what's the worst-case impact on our systems?

What are oNabu's SLA commitments and incident response times?

How are data breaches handled and communicated?

Compliance

What certifications does oNabu hold?

How is continuous compliance monitored between annual audits?

Does oNabu sign Data Processing Agreements (DPAs)?

Who are oNabu's AI sub-processors and what data do they receive?