diff --git a/docs/enterprise-readiness.md b/docs/enterprise-readiness.md
new file mode 100644
index 00000000..d630bb72
--- /dev/null
+++ b/docs/enterprise-readiness.md
@@ -0,0 +1,34 @@
+# Enterprise security pages — review notes
+
+Draft for Oct 22, 2026. No publication authorized.
+
+## Merge blockers and human actions
+
+1. Khaliq/Workspace administrator: create the `security@agentrelay.com` Google Group, choose responsible recipients, and verify an inbound test reaches them. Agents have not changed accounts, mailboxes, permissions, or DNS.
+2. Khaliq: approve the vulnerability disclosure policy, safe harbor, and response targets. These are proposed commitments, not verification of operational response capacity.
+3. Confirm the preliminary provider inventory against actual production traffic and contracts with the security owner. The page labels it unconfirmed; do not describe it as a final subprocessor list.
+4. Obtain the repository-required independent reviews. Keep this PR draft and do not add an auto-merge label.
+
+## Claim evidence
+
+Source drafts: operations PR #1, branch `soc2/ops-drafts`, `enterprise-readiness/trust-page.md` and `compliance/soc2/policies/vulnerability-disclosure.md`.
+
+Cloud verification at origin/main `8b9339aff`:
+- `packages/web/lib/members/member-store.ts`: assignable roles owner/member.
+- `packages/web/lib/workflows/cancel-workflow-run.ts`: individual hosted-run cancellation; local runs return a refusal.
+- `packages/web/lib/auth/api-token-store.ts`: individual token revocation.
+- `packages/web/lib/auth/read-only-sandbox-auth.ts` and `lib/workflows/launch-runner.ts`: existing constrained flow read-only authority; not generic suggest mode.
+- `packages/web/lib/workflows/run-data-retention.ts`: workspace-configured retention; no finite default.
+- BYOK credential routes and workflow human-answer route: customer keys and per-flow approvals.
+
+The inventory uses operations `compliance/soc2/inventories/vendors.md`, explicitly a draft. Cloud infrastructure entries are repository evidence, not live account or region verification. Encryption algorithms, blanket TLS coverage, fixed regions, automatic deletion deadlines, training/ZDR guarantees, completed audits, and blanket full action logs are deliberately omitted pending stronger evidence.
+
+## Proposed privacy reconciliation (requires owner/counsel review)
+
+The existing `/privacy` policy names GitHub, Slack, Nango, Stripe, PostHog, OpenAI embeddings and Anthropic replies. Add the following paragraphs to “How we share information” after confirming actual use:
+
+> Hosted services use Cloudflare, Amazon Web Services, and Neon for application hosting, networking, storage, and databases. Depending on enabled features, agent execution uses [confirmed sandbox providers]; authorized integrations use [Nango/Composio and connected services]; meeting recording and transcription use [Recall.ai/Modal/Hookdeck]; memory and evaluation use [confirmed providers]; and transactional email uses Resend.
+>
+> Agent workflows may send task content to [confirmed Anthropic/OpenAI/xAI/Google Gemini/OpenRouter/Cursor providers] when using Agent Relay-managed credentials. OpenRouter may route to downstream providers identified in the finalized register. Customer-supplied model credentials use the provider selected by the customer; applicable retention and training terms depend on that provider and agreement.
+
+Do not publish the bracketed proposal or claim ZDR. Resolve active sandbox/memory providers, processing countries, contracting entities, downstream model routing, and notice requirements. Reconcile both pages in the same approved change. This PR adds a cross-link so the preliminary inventory is visible, but does not silently rewrite the legal policy.
diff --git a/web/app/enterprise/page.tsx b/web/app/enterprise/page.tsx
index eef0daf9..5bcd76f9 100644
--- a/web/app/enterprise/page.tsx
+++ b/web/app/enterprise/page.tsx
@@ -1,5 +1,6 @@
import type { Metadata } from 'next';
import Image from 'next/image';
+import Link from 'next/link';
import {
ArrowRight,
Braces,
@@ -395,6 +396,7 @@ export default function EnterprisePage() {
+
See our trust page for the preliminary, unconfirmed provider inventory and current controls.
We do not sell personal information. We share information with service providers only as needed to
operate Agent Relay, with integrations you connect, as directed by workspace administrators, to
diff --git a/web/app/security/page.tsx b/web/app/security/page.tsx
new file mode 100644
index 00000000..a45789db
--- /dev/null
+++ b/web/app/security/page.tsx
@@ -0,0 +1,47 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import { GitHubStarsBadge } from '../../components/GitHubStars';
+import { SiteFooter } from '../../components/SiteFooter';
+import { SiteNav } from '../../components/SiteNav';
+import { absoluteUrl } from '../../lib/site';
+import s from '../legal.module.css';
+
+export const metadata: Metadata = {
+ title: 'Vulnerability disclosure — Agent Relay',
+ description: 'How to report security vulnerabilities in Agent Relay.',
+ alternates: { canonical: absoluteUrl('/security') },
+};
+
+export default function Page() {
+ return (
+
+ } />
+
+
Last reviewed: October 14, 2026
+
Vulnerability disclosure
+
Help us keep Agent Relay and its users safe.
+
+
Report a vulnerability
+
Email security@agentrelay.com or use GitHub private security reporting. Please include the affected product, version or URL, potential impact, and steps to reproduce or a proof of concept. Keep reports private and omit unnecessary personal data and credentials.
+
We aim to acknowledge reports within two business days, provide an initial assessment within ten business days, and keep you informed until resolution.
+
+
+
Scope
+
Agent Relay Cloud and hosted services under agentrelay.com, Desktop and CLI releases, and open-source repositories in the AgentWorkforce GitHub organization are in scope.
+
Social engineering, physical attacks, denial-of-service testing, automated scanner findings without demonstrated impact, and third-party services we do not operate are out of scope. Report upstream vulnerabilities to the upstream project.
+
+
+
Good-faith research and safe harbor
+
We will not pursue legal action for good-faith research that avoids privacy violations, data destruction, and service disruption; uses only accounts you own or have explicit permission to test; and does not access or retain other users' data beyond what is needed to demonstrate the issue.
+
Give us reasonable time to fix an issue before public disclosure. We aim for coordinated disclosure within 90 days and will discuss timing with you.
+
+
+
Recognition
+
We do not currently run a paid bug bounty. With your permission, we can credit your contribution publicly.
+
See our trust page for current product controls and readiness gaps.
+
+
+
+
+ );
+}
diff --git a/web/app/sitemap.ts b/web/app/sitemap.ts
index f6cbccdf..90569048 100644
--- a/web/app/sitemap.ts
+++ b/web/app/sitemap.ts
@@ -135,6 +135,9 @@ export default function sitemap(): MetadataRoute.Sitemap {
changeFrequency: 'monthly',
priority: 0.5,
},
+ ...['/trust', '/security'].map((path) => ({
+ url: absoluteUrl(path), lastModified: now, changeFrequency: 'monthly' as const, priority: 0.5,
+ })),
{
url: absoluteUrl('/privacy'),
lastModified: now,
diff --git a/web/app/trust/page.tsx b/web/app/trust/page.tsx
new file mode 100644
index 00000000..d4621895
--- /dev/null
+++ b/web/app/trust/page.tsx
@@ -0,0 +1,70 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import { GitHubStarsBadge } from '../../components/GitHubStars';
+import { SiteFooter } from '../../components/SiteFooter';
+import { SiteNav } from '../../components/SiteNav';
+import { absoluteUrl } from '../../lib/site';
+import s from '../legal.module.css';
+
+export const metadata: Metadata = {
+ title: 'Security and trust — Agent Relay',
+ description: 'Current Agent Relay controls, data handling, and enterprise readiness.',
+ alternates: { canonical: absoluteUrl('/trust') },
+};
+
+export default function Page() {
+ return (
+
+ } />
+
+
Last reviewed: October 14, 2026
+
Security and trust
+
Current capabilities and open enterprise-readiness work. Items marked ⏳ are pending and are not available commitments.
+
+
Agent controls
+
RelayAuth supports scoped agent credentials. Cloud supports cancellation of individual workflow runs and revocation of individual tokens. Human approval gates can be configured per flow; approval is not a universal requirement for every write.
+
Cloud sign-in uses Google OAuth. Organization roles are owner and member. Workflow run history is available; it is not a comprehensive customer-visible security audit log.
+
⏳ Workspace-wide emergency controls, general read-only/suggest mode, enterprise SSO (SAML/OIDC), and a customer-visible security audit log.
+
+
+
Deployment and data flow
+
The hosted Cloud product connects authorized integrations, executes agent workflows in sandboxes, and records run data. Connected tools and model providers receive data required for the requested work. Cloud supports bring-your-own model keys.
+
The open-source core and Software Factory can run in your infrastructure. External integrations and model APIs still receive data when you configure them. The full Cloud product does not currently have self-host packaging.
+
⏳ Single-tenant and private-cloud packaging for the full Cloud product.
+
+
+
Data protection and retention
+
Cloud uses Cloudflare and AWS infrastructure and a Neon database. Confirm region and feature-specific data flows with us before a pilot.
+
Workspace run-data retention is configurable. Its default is to keep data indefinitely. Account deletion currently records a request for manual handling; automated completion is pending.
+
Review the privacy policy for collection, model processing, retention, and deletion details, and telemetry documentation for opt-out instructions.
+
⏳ A contractual no-training clause and confirmed zero-data-retention coverage for all model providers. We do not represent these as completed.
+
+
+
Provider inventory — unconfirmed
+
This is a preliminary inventory from repository evidence, not a finalized subprocessor register. Actual production use, processing locations, contracting entities, and downstream model providers require confirmation. Not every provider is used for every customer.