Trust Centre
How Boundary is built, secured and operated.
For security and compliance teams, procurement leads, data-protection officers and anyone conducting a vendor assessment. Each module below states the current position accurately. Nothing is implied and no certification is claimed before it is held. The security contact and responsible-disclosure policy are listed at the foot of the page.
On this pageOverview
Security Overview
Boundary is designed to operate securely as a runtime governance layer. Six security principles are applied at every layer of the platform. Each is enforced in code, not policy text.
Least Privilege
No AI system receives more context than the specific interaction requires.
Scoped access is enforced at the connector level. Broad permission grants are not supported.
Fail-Closed by Default
Unclassifiable fields are withheld and detected threats are blocked. There is no open fallback.
If a request cannot be processed correctly, context is withheld rather than passed through.
Scoped Connector Access
Connector authorisation is limited to the minimum required fields per workflow.
Per-user OAuth. No shared credential stores between customers.
Tokenisation
Sensitive field values are replaced with structured tokens before context reaches the AI model.
Tokens are user-scoped with a 7-day expiry, renewed on access. Boundary never shares the underlying value with the AI model.
Auditability
Every governed interaction produces a structured, tamper-evident, append-only, hash-chained record.
Records state: what was requested, which policy applied, what was withheld and the outcome.
Tenant Isolation
Customer data, policies, audit logs and connector credentials are isolated per tenant and enforced on every query.
Enforced by the database engine through row-level security, not by application code that has to remember to filter. Where an organisation requires its own infrastructure, Boundary can be deployed on-premise as a single-tenant instance.
Encryption
- In transit: all external traffic is served over TLS 1.2 or higher.
- At rest: sensitive data (the entity-resolution substrate, connector credentials, access tokens and one-time-password secrets) is encrypted with AES-256-GCM, with keys generated uniquely per deployment.
Architecture Overview
Copilot, ChatGPT, Claude, Mistral and other assistants request business context.
Classifies every field, then tokenises or withholds it under customer policy. Fail-closed.
CRM, email, documents and ticketing stay the source of truth.
The full Security & Architecture Overview, including the detailed architecture diagram and data-flow specifics, is available to security and procurement teams on request.
Request the full overviewBoundary sits between AI assistants and business systems. It does not interact with model-provider infrastructure. It is not a data warehouse: it keeps only a minimal, encrypted resolution record needed to tokenise data. Customer data, policies, audit logs and connector credentials are isolated at the database row level with enforced row-level security.
Three deployment zones
- Customer environment: the AI client (Copilot, ChatGPT, Claude, Mistral) and the customer identity provider (Azure AD, Okta, SSO and MFA).
- Boundary Control platform: the governance gateway. Every field is classified, evaluated against customer policy, and recorded in a tamper-evident, append-only audit log.
- Governed systems: CRM (Salesforce, HubSpot), email and documents (Microsoft 365, Google), ticketing (Jira, ServiceNow), knowledge base (Confluence, Notion).
Classification pipeline
Five classification layers are applied inline to every field before context reaches the model. Tier 3 (withheld) is the default for unknown fields.
Enforcement
Six enforcement functions applied to every governed interaction: Intercept, Inspect, Enforce, Threat Detection, Log, Audit. Fail-closed. No asynchronous bypass path.
Data Processing
Boundary does not train models on customer data and is not a general data warehouse. To replace sensitive values with stable tokens, it keeps a minimal, encrypted resolution record.
- Resolvable field detail (the values behind a token) auto-expires on a 7-day rolling window.
- A minimal identity record, used to keep tokens stable across requests and applications, is retained while you remain a customer and is removed on offboarding.
- Audit records are retained under a configurable retention period for compliance. Raw business records are processed in transit and are not warehoused.
Five-step processing path
- Request intercepted
The AI client issues a tool request. Boundary handles the call and processes the response before it returns to the AI.
- Classification applied
Each field passes through the five-layer classification pipeline. Sensitive values are identified for policy evaluation.
- Policy evaluated
Customer-defined policy is applied to each classified field. The outcome is determined per value.
- Approved context returned
The AI assistant receives only tokens and approved fields, never the raw values behind them, and never withheld fields.
- Interaction recorded
A structured audit record captures the request, policy applied, classification outcome and data handling.
- timestamp
- 2026-07-02T14:31:07Z
- request
- contact record lookup (CRM)
- policy
- sales-default-v3
- classification
- 8 fields: 5 allowed, 2 tokenised, 1 withheld
- withheld
- custom_risk_note (unrecognised field, withheld by default)
- outcome
- Allowed approved context returned
- prev_hash
- 9c41e2b07a5f...d83c
- hash
- f27a80c31b9e...54d6
Four trust boundaries
| Boundary | Statement |
|---|---|
| Minimal retention | Boundary is not a data warehouse and does not train on customer data. Resolvable field detail auto-expires on a 7-day rolling window; a minimal identity record persists while you are a customer and is removed on offboarding. |
| Customer data ownership | Customer data remains under customer control; Boundary processes and tokenises it under your policy. |
| Model provider boundary | Boundary sits between AI and business systems. It does not interact with model-provider infrastructure. |
| Fail-closed design | If a request cannot be processed correctly, the default is withholding. Context is not passed through ungoverned paths. |
Prompt logging
Boundary records what was classified, which policy applied, and what was withheld. User prompt content is not recorded.
Subprocessors
The table below lists the third-party services used by Boundary to deliver the platform. For each subprocessor, the purpose and location are stated.
The current subprocessor list is supplied on request while our quarterly review completes, and will be published on this page. Request it from [email protected].
Changes to subprocessors are communicated to customers in advance. To receive change notifications, contact [email protected].
Data Residency
Boundary offers deployment within specific geographic regions. Customer data is processed within the selected region. Regulatory data location requirements for the ICO and UK GDPR are supported through UK regional deployment, with EU deployment to follow.
| Region | Status | Notes |
|---|---|---|
| United Kingdom | Live | UK region. Supports ICO and UK GDPR requirements. |
| European Union | Planned | Planned EU region; location to be confirmed. |
| United States | Planned | Planned US region; location to be confirmed. |
| On-premise | Available | Single-tenant deployment in the customer's own environment, where data location or separation requirements call for it. |
US availability is planned and is not implied before it is operational. On-premise deployment is offered where an organisation requires it, and is scoped per engagement.
Compliance Roadmap
The status of each item is stated as of July 2026. This roadmap is reviewed and updated quarterly. No certification is claimed before it is held.
| Framework / Standard | Status | Notes |
|---|---|---|
| UK GDPR | Operational | Data minimisation by design, audit evidence, UK regional deployment. |
| EU GDPR | Aligned by design | Data minimisation by design, audit evidence; EU deployment planned. |
| EU AI Act | Aligned by design | Supports governance evidence for regulated AI workflows. Obligations are phasing in over the coming years; implementation timelines remain subject to ongoing EU revision. |
| SOC 2 Type II | In preparation | Preparation underway; timeline to be confirmed. |
| ISO 27001 | Planned | To follow SOC 2. |
| Cyber Essentials Plus | Planned | UK programme. |
Security FAQ
These questions and answers are approved for the website. They are also published as a downloadable questionnaire pre-fill to accelerate procurement review.
Where is customer data stored?
Boundary does not train models on customer data and is not a general data warehouse. To replace sensitive values with stable tokens it keeps a minimal, encrypted resolution record: resolvable field detail (the values behind a token) auto-expires on a 7-day rolling window, and a minimal identity record (which keeps tokens stable across requests and applications) is retained while you remain a customer and removed on offboarding. Audit records and policy configurations are stored within the selected deployment region under a configurable retention period. Raw business records are processed in transit and are not warehoused.
How is data encrypted?
All external traffic is served over TLS 1.2 or higher. Sensitive data at rest (the entity-resolution substrate, connector credentials, access tokens and one-time-password secrets) is encrypted with AES-256-GCM, with encryption keys generated uniquely per deployment.
Who can access customer data?
Customer data, policy configurations, audit logs and connector credentials are logically separated at the platform level. Boundary staff do not access customer business data in the normal operation of the platform.
Are user prompts recorded?
No. Boundary records what was classified, which policy applied and what was withheld. User prompt content is not logged.
What happens if Boundary is unavailable?
The default is to withhold context from business systems. Governance does not fail open. If Boundary cannot process a request correctly, AI context from business systems is withheld and the AI tool continues to operate without access to that context.
How are connectors authorised?
Each connector uses per-user OAuth scoped to the minimum fields required for the workflow. No broad permission grants are supported. Connector tokens are logically separated across customers.
What is the audit log retention period?
Retention is configurable to meet customer requirements. Audit records are exportable for SIEM and compliance workflows.
How does Boundary handle a security incident or data breach?
Customers are notified of security incidents in accordance with the terms of their agreement and applicable regulatory requirements.
What are the SLA and support terms?
Standard support terms are provided with all deployments. Specific SLA and support-tier details are agreed as part of the commercial terms. Contact [email protected] for detail.
What is the process for data deletion on offboarding?
Customer data, configurations and credentials are deleted in accordance with the terms agreed in the data-processing agreement.
Does Boundary support UK GDPR and EU GDPR compliance?
Boundary is designed to support GDPR compliance obligations, including data minimisation, audit evidence and regional data residency.
Security Contact
To report a security concern or vulnerability, contact the Boundary security team directly.
Email: [email protected]
Responsible Disclosure
Boundary operates a coordinated disclosure policy. If you discover a security vulnerability affecting Boundary or the services it governs, we ask that you report it to us before public disclosure.
Scope
- The Boundary Control platform, including its API and management application.
- The management console and authentication systems.
- The published connector integrations within the platform.
Out of scope
- Vulnerabilities in third-party AI tools, AI model providers or end-user AI clients.
- Social engineering or phishing attacks on Boundary staff.
Safe harbour
Boundary will not take legal action against researchers who act in good faith within the scope of this policy. We ask that you do not access, modify or delete customer data; do not disrupt the service; and report findings promptly.
Process
- Report by email to [email protected]. Include a description, reproduction steps and supporting evidence where possible.
- Boundary will acknowledge receipt within three business days.
- Boundary will provide an estimated resolution timeline and keep you informed through the remediation process.
- Public disclosure is coordinated with Boundary following remediation.
Downloads
The following documents are available ungated. No form is required.
| Document | Description | Access |
|---|---|---|
| Security & Architecture Overview | Full technical overview of the Boundary control plane, classification pipeline and security design. | Request |
| Security FAQ: Questionnaire Pre-fill | Pre-completed answers to standard vendor security questions, formatted for procurement review. | Request |
| Data Processing Summary | One-page statement of how Boundary processes customer business data. | Request |
| Subprocessor List | Named subprocessors with purpose and location. | Request |
Documents are currently supplied by email on request. Direct downloads are being prepared.