Add enterprise trust and vulnerability disclosure pages

docs/enterprise-readiness.md

@@ -0,0 +1,34 @@
+# Enterprise security pages — review notes
+
+Draft for Oct 22, 2026. No publication authorized.
+
+## Merge blockers and human actions
+
+1. Khaliq/Workspace administrator: create the `security@agentrelay.com` Google Group, choose responsible recipients, and verify an inbound test reaches them. Agents have not changed accounts, mailboxes, permissions, or DNS.
+2. Khaliq: approve the vulnerability disclosure policy, safe harbor, and response targets. These are proposed commitments, not verification of operational response capacity.
+3. Confirm the preliminary provider inventory against actual production traffic and contracts with the security owner. The page labels it unconfirmed; do not describe it as a final subprocessor list.
+4. Obtain the repository-required independent reviews. Keep this PR draft and do not add an auto-merge label.
+
+## Claim evidence
+
+Source drafts: operations PR #1, branch `soc2/ops-drafts`, `enterprise-readiness/trust-page.md` and `compliance/soc2/policies/vulnerability-disclosure.md`.
+
+Cloud verification at origin/main `8b9339aff`:
+- `packages/web/lib/members/member-store.ts`: assignable roles owner/member.
+- `packages/web/lib/workflows/cancel-workflow-run.ts`: individual hosted-run cancellation; local runs return a refusal.
+- `packages/web/lib/auth/api-token-store.ts`: individual token revocation.
+- `packages/web/lib/auth/read-only-sandbox-auth.ts` and `lib/workflows/launch-runner.ts`: existing constrained flow read-only authority; not generic suggest mode.
+- `packages/web/lib/workflows/run-data-retention.ts`: workspace-configured retention; no finite default.
+- BYOK credential routes and workflow human-answer route: customer keys and per-flow approvals.
+
+The inventory uses operations `compliance/soc2/inventories/vendors.md`, explicitly a draft. Cloud infrastructure entries are repository evidence, not live account or region verification. Encryption algorithms, blanket TLS coverage, fixed regions, automatic deletion deadlines, training/ZDR guarantees, completed audits, and blanket full action logs are deliberately omitted pending stronger evidence.
+
+## Proposed privacy reconciliation (requires owner/counsel review)
+
+The existing `/privacy` policy names GitHub, Slack, Nango, Stripe, PostHog, OpenAI embeddings and Anthropic replies. Add the following paragraphs to “How we share information” after confirming actual use:
+
+> Hosted services use Cloudflare, Amazon Web Services, and Neon for application hosting, networking, storage, and databases. Depending on enabled features, agent execution uses [confirmed sandbox providers]; authorized integrations use [Nango/Composio and connected services]; meeting recording and transcription use [Recall.ai/Modal/Hookdeck]; memory and evaluation use [confirmed providers]; and transactional email uses Resend.
+>
+> Agent workflows may send task content to [confirmed Anthropic/OpenAI/xAI/Google Gemini/OpenRouter/Cursor providers] when using Agent Relay-managed credentials. OpenRouter may route to downstream providers identified in the finalized register. Customer-supplied model credentials use the provider selected by the customer; applicable retention and training terms depend on that provider and agreement.
+
+Do not publish the bracketed proposal or claim ZDR. Resolve active sandbox/memory providers, processing countries, contracting entities, downstream model routing, and notice requirements. Reconcile both pages in the same approved change. This PR adds a cross-link so the preliminary inventory is visible, but does not silently rewrite the legal policy.

web/app/enterprise/page.tsx

@@ -1,5 +1,6 @@
 import type { Metadata } from 'next';
 import Image from 'next/image';
+import Link from 'next/link';
 import {
   ArrowRight,
   Braces,
@@ -395,6 +396,7 @@ export default function EnterprisePage() {
         </section>
       </main>
 
+      <p style={{ textAlign: 'center', padding: '24px' }}><Link href="/trust">Review current security controls and readiness</Link></p>
       <SiteFooter />
     </div>
   );

web/app/privacy/page.tsx

@@ -191,6 +191,7 @@ export default function PrivacyPage() {
 
         <section className={s.section}>
           <h2>How we share information</h2>
+          <p>See our <Link href="/trust">trust page</Link> for the preliminary, unconfirmed provider inventory and current controls.</p>
           <p>
             We do not sell personal information. We share information with service providers only as needed to
             operate Agent Relay, with integrations you connect, as directed by workspace administrators, to

web/app/security/page.tsx

@@ -0,0 +1,47 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import { GitHubStarsBadge } from '../../components/GitHubStars';
+import { SiteFooter } from '../../components/SiteFooter';
+import { SiteNav } from '../../components/SiteNav';
+import { absoluteUrl } from '../../lib/site';
+import s from '../legal.module.css';
+
+export const metadata: Metadata = {
+  title: 'Vulnerability disclosure — Agent Relay',
+  description: 'How to report security vulnerabilities in Agent Relay.',
+  alternates: { canonical: absoluteUrl('/security') },
+};
+
+export default function Page() {
+  return (
+    <div className={s.page}>
+      <SiteNav actions={<GitHubStarsBadge />} />
+      <main className={s.content}>
+        <p className={s.meta}>Last reviewed: October 14, 2026</p>
+        <h1 className={s.title}>Vulnerability disclosure</h1>
+        <p className={s.subtitle}>Help us keep Agent Relay and its users safe.</p>
+        <section className={s.section}>
+          <h2>Report a vulnerability</h2>
+          <p>Email <a href="mailto:security@agentrelay.com">security@agentrelay.com</a> or use <a href="https://github.com/AgentWorkforce/relay/security/advisories/new">GitHub private security reporting</a>. Please include the affected product, version or URL, potential impact, and steps to reproduce or a proof of concept. Keep reports private and omit unnecessary personal data and credentials.</p>
+          <p>We aim to acknowledge reports within two business days, provide an initial assessment within ten business days, and keep you informed until resolution.</p>
+        </section>
+        <section className={s.section}>
+          <h2>Scope</h2>
+          <p>Agent Relay Cloud and hosted services under agentrelay.com, Desktop and CLI releases, and open-source repositories in the AgentWorkforce GitHub organization are in scope.</p>
+          <p>Social engineering, physical attacks, denial-of-service testing, automated scanner findings without demonstrated impact, and third-party services we do not operate are out of scope. Report upstream vulnerabilities to the upstream project.</p>
+        </section>
+        <section className={s.section}>
+          <h2>Good-faith research and safe harbor</h2>
+          <p>We will not pursue legal action for good-faith research that avoids privacy violations, data destruction, and service disruption; uses only accounts you own or have explicit permission to test; and does not access or retain other users&apos; data beyond what is needed to demonstrate the issue.</p>
+          <p>Give us reasonable time to fix an issue before public disclosure. We aim for coordinated disclosure within 90 days and will discuss timing with you.</p>
+        </section>
+        <section className={s.section}>
+          <h2>Recognition</h2>
+          <p>We do not currently run a paid bug bounty. With your permission, we can credit your contribution publicly.</p>
+          <p>See our <Link href="/trust">trust page</Link> for current product controls and readiness gaps.</p>
+        </section>
+      </main>
+      <SiteFooter />
+    </div>
+  );
+}

web/app/sitemap.ts

@@ -135,6 +135,9 @@ export default function sitemap(): MetadataRoute.Sitemap {
       changeFrequency: 'monthly',
       priority: 0.5,
     },
+    ...['/trust', '/security'].map((path) => ({
+      url: absoluteUrl(path), lastModified: now, changeFrequency: 'monthly' as const, priority: 0.5,
+    })),
     {
       url: absoluteUrl('/privacy'),
       lastModified: now,

web/app/trust/page.tsx

@@ -0,0 +1,70 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import { GitHubStarsBadge } from '../../components/GitHubStars';
+import { SiteFooter } from '../../components/SiteFooter';
+import { SiteNav } from '../../components/SiteNav';
+import { absoluteUrl } from '../../lib/site';
+import s from '../legal.module.css';
+
+export const metadata: Metadata = {
+  title: 'Security and trust — Agent Relay',
+  description: 'Current Agent Relay controls, data handling, and enterprise readiness.',
+  alternates: { canonical: absoluteUrl('/trust') },
+};
+
+export default function Page() {
+  return (
+    <div className={s.page}>
+      <SiteNav actions={<GitHubStarsBadge />} />
+      <main className={s.content}>
+        <p className={s.meta}>Last reviewed: October 14, 2026</p>
+        <h1 className={s.title}>Security and trust</h1>
+        <p className={s.subtitle}>Current capabilities and open enterprise-readiness work. Items marked ⏳ are pending and are not available commitments.</p>
+        <section className={s.section}>
+          <h2>Agent controls</h2>
+          <p>RelayAuth supports scoped agent credentials. Cloud supports cancellation of individual workflow runs and revocation of individual tokens. Human approval gates can be configured per flow; approval is not a universal requirement for every write.</p>
+          <p>Cloud sign-in uses Google OAuth. Organization roles are owner and member. Workflow run history is available; it is not a comprehensive customer-visible security audit log.</p>
+          <p>⏳ Workspace-wide emergency controls, general read-only/suggest mode, enterprise SSO (SAML/OIDC), and a customer-visible security audit log.</p>
+        </section>
+        <section className={s.section}>
+          <h2>Deployment and data flow</h2>
+          <p>The hosted Cloud product connects authorized integrations, executes agent workflows in sandboxes, and records run data. Connected tools and model providers receive data required for the requested work. Cloud supports bring-your-own model keys.</p>
+          <p>The open-source core and Software Factory can run in your infrastructure. External integrations and model APIs still receive data when you configure them. The full Cloud product does not currently have self-host packaging.</p>
+          <p>⏳ Single-tenant and private-cloud packaging for the full Cloud product.</p>
+        </section>
+        <section className={s.section}>
+          <h2>Data protection and retention</h2>
+          <p>Cloud uses Cloudflare and AWS infrastructure and a Neon database. Confirm region and feature-specific data flows with us before a pilot.</p>
+          <p>Workspace run-data retention is configurable. Its default is to keep data indefinitely. Account deletion currently records a request for manual handling; automated completion is pending.</p>
+          <p>Review the <Link href="/privacy">privacy policy</Link> for collection, model processing, retention, and deletion details, and <Link href="/telemetry">telemetry documentation</Link> for opt-out instructions.</p>
+          <p>⏳ A contractual no-training clause and confirmed zero-data-retention coverage for all model providers. We do not represent these as completed.</p>
+        </section>
+        <section className={s.section}>
+          <h2>Provider inventory — unconfirmed</h2>
+          <p>This is a preliminary inventory from repository evidence, not a finalized subprocessor register. Actual production use, processing locations, contracting entities, and downstream model providers require confirmation. Not every provider is used for every customer.</p>
+          <div className={s.tableWrapper}>
+            <table className={s.table}>
+              <thead><tr><th>Providers</th><th>Potential processing purpose</th><th>Verification</th></tr></thead>
+              <tbody>
+                <tr><td>Cloudflare, AWS, Neon</td><td>Hosting, storage, database, networking</td><td>Locations and production scope unconfirmed</td></tr>
+                <tr><td>Daytona, E2B, Vercel Sandbox, Freestyle, Agent37, Microsandbox</td><td>Agent execution</td><td>Active providers and locations unconfirmed</td></tr>
+                <tr><td>Anthropic, OpenAI, xAI, Google Gemini, OpenRouter, Cursor</td><td>Model inference; OpenAI session embeddings</td><td>Routing, locations, and retention terms unconfirmed</td></tr>
+                <tr><td>Nango, Composio, GitHub, Slack, Dropbox</td><td>Authorized integrations and data movement</td><td>Feature-specific scope unconfirmed</td></tr>
+                <tr><td>Recall.ai, Modal, Hookdeck</td><td>Meeting recording, transcription, webhooks</td><td>Feature-specific scope and locations unconfirmed</td></tr>
+                <tr><td>Supermemory, Typesafe.ai</td><td>Agent memory and session evaluation</td><td>Production traffic unconfirmed</td></tr>
+                <tr><td>Stripe, PostHog, Resend</td><td>Billing, analytics, transactional email</td><td>Locations and contract details unconfirmed</td></tr>
+              </tbody>
+            </table>
+          </div>
+        </section>
+        <section className={s.section}>
+          <h2>Compliance and security review</h2>
+          <p>⏳ SOC 2 platform and auditor engagement, audit dates, and penetration-test attestation. No completed SOC 2 or penetration-test claim is made here.</p>
+          <p>For a pilot, agree the data boundary, integration scopes, approval gates, retention, and support terms with us before granting access.</p>
+          <p>Report vulnerabilities through our <Link href="/security">vulnerability disclosure policy</Link>.</p>
+        </section>
+      </main>
+      <SiteFooter />
+    </div>
+  );
+}

web/components/SiteFooter.tsx

@@ -60,6 +60,8 @@ const footerColumns: FooterColumn[] = [
       { label: 'Support', href: '/support' },
       { label: 'Telemetry', href: '/telemetry' },
       { label: 'Privacy', href: '/privacy' },
+      { label: 'Trust', href: '/trust' },
+      { label: 'Security', href: '/security' },
       { label: 'Terms', href: '/terms' },
       { label: 'Contact', href: `mailto:${SITE_EMAIL}` },
     ],

web/lib/agent-discovery.ts

@@ -6,7 +6,7 @@
 // exist — the docs pages and the published OpenAPI specs — so the manifests
 // stay true without a separate source of truth to keep in sync.
 
-import { SITE_EMAIL, SITE_URL, absoluteUrl } from './site';
+import { SITE_URL, absoluteUrl } from './site';
 
 const RELAYCAST_OPENAPI_URL =
   'https://raw.githubusercontent.com/AgentWorkforce/relaycast/main/openapi.yaml';
@@ -27,11 +27,12 @@ export function getSecurityTxt(now: Date): string {
     '# Agent Relay security contact (RFC 9116).',
     '# Report a vulnerability by email; we acknowledge within two business days.',
     '',
-    `Contact: mailto:${SITE_EMAIL}`,
+    'Contact: mailto:security@agentrelay.com',
+    'Contact: https://github.com/AgentWorkforce/relay/security/advisories/new',
     `Expires: ${securityTxtExpiry(now)}`,
     'Preferred-Languages: en',
     `Canonical: ${absoluteUrl('/.well-known/security.txt')}`,
-    `Policy: ${absoluteUrl('/terms')}`,
+    `Policy: ${absoluteUrl('/security')}`,
     '',
   ].join('\n');
 }

web/lib/test/agent-discovery.test.ts

@@ -6,10 +6,12 @@ describe('security.txt', () => {
   it('carries the RFC 9116 required fields', () => {
     const txt = getSecurityTxt(new Date('2026-08-21T00:00:00Z'));
 
-    expect(txt).toContain('Contact: mailto:hello@agentrelay.com');
+    expect(txt).toContain('Contact: mailto:security@agentrelay.com');
     expect(txt).toContain('Expires: 2027-08-21T00:00:00Z');
     expect(txt).toContain('Canonical: https://agentrelay.com/.well-known/security.txt');
     expect(txt).toContain('Preferred-Languages: en');
+    expect(txt).toContain('Contact: https://github.com/AgentWorkforce/relay/security/advisories/new');
+    expect(txt).toContain('Policy: https://agentrelay.com/security');
   });
 
   it('always expires in the future', () => {