Every system Instract builds runs inside the client's own controls. People and AI agents work under the same access rules, approvals and audit trail, and the client keeps its data and its code.
- Hosting
- Client cloud, on premises or managed
- Sign in
- Single sign-on with your directory
- Code
- Owned by the client
Your environment
We deploy each system in the client's own cloud account, on the client's premises, or as a managed service in a region the client chooses. Each client's system runs separately, with its own database and keys. Production, staging and development are kept apart, and only named Instract engineers approved by the client can reach production.
Access
People sign in through the client's directory with single sign-on. Every role starts with the least access its work requires, and the system proves that each role can reach only what it should. Risky actions, such as payments above a threshold or changes to supplier bank details, need a second person to approve them.
AI agents
Agents are members of staff with a role. They read records and propose actions under the same access rules and approval limits as people, and anything above their limit is held for a named person to decide. Each agent runs on a pinned model version, and changing a model, prompt or tool needs the client's sign-off and passes the agent's evaluations first. Client data is never used to train models.
Data protection
Data is encrypted in transit and at rest, and stays in the region the client selects. Personal fields are marked in the system's definitions, masked in logs and traces, and prompt text is not stored in traces. Files people and agents upload are kept in one store with the same access rules as the records they belong to.
Audit and change
Every action by a person or an agent is written to an audit trail that shows who did what, when and under which rule. Changes to a running system go through a change request that shows its effect on data, access and behaviour before the client signs it off, and every release records who approved it.
Ownership and exit
The client owns the code of its system and its data. At any time the client can export its data in open formats and run the system without us.
Reporting a vulnerability
If you believe you have found a security issue in our website or a system we operate, write to security@instract.ai with the details and steps to reproduce it. We will confirm receipt within two business days and keep you informed until it is fixed. Please do not access data that is not yours or disrupt service while testing.