Security
How Saifuro handles data, and how certifications are reported.
Saifuro is built to hold as little as possible. The less we store, the less there is to lose, and the shorter the list of questions your security team has to work through.
What we do and do not hold
| Card data | Captured and tokenized by VGS before it reaches us. Primary account numbers never enter Saifuro systems, which keeps PCI scope narrow. |
| Customer funds | Never held. Settlement is executed by licensed payment providers. |
| Agent conversations | Not collected. We see the spend request, not the reasoning that produced it. |
| Decision log | Append only, exportable by the customer at any time. |
Controls
Data is encrypted in transit and at rest. Access is role based and reviewed. Customer environments are isolated from each other.
Records are appended, never edited and never deleted. A correction is a new record, so the log can be replayed to any point in time and no single administrator can quietly change history.
The third parties that process data on our behalf are listed in subprocessors, together with what each one sees. Data residency and retention windows are set per deployment.
Threat model
A control an agent can route around is a recommendation. Three things decide whether a bypass is possible: who the caller proves to be, what an approval is actually good for, and where payment credentials sit.
Agent identity
Credentials are issued per agent at onboarding, not per installation. An agent authenticates as itself, so a mandate attaches to an identity and not to a name in a request body.
This is what makes the rest of the model meaningful. One shared key across a customer environment would let any process there spend under any mandate, and every limit in the policy would rest on the assumption that nothing inside the perimeter lies about who it is.
What a verdict is good for
A verdict is not a boolean. It is signed by Saifuro and bound to the request that produced it: amount, recipient, mandate, policy version, and a nonce are covered by the signature, and an approval carries a short expiry.
An approval for one purchase therefore cannot be replayed for a second one, reused at a larger amount, or edited in transit. The signing key is provided with the integration tooling at onboarding, so a counterparty can verify an approval without access to Saifuro and without taking the other side's word for it. In agent to agent settlement, that turns a dispute into a check.
Credential placement
What stops a bypass at the settlement step depends on where payment credentials sit, and that is not the same on every rail.
| Control mode | Where credentials sit | What holds |
|---|---|---|
| Preventive | Behind the Saifuro edge. Agent traffic to the provider passes through it, and credentials are substituted in the VGS proxy after the verdict | The agent holds aliases, not credentials. Skipping the authorization call leaves it with nothing to pay with |
| Detective | In the customer environment | Every spend is still evaluated and recorded, deviations surface in reconciliation, and a mandate is revocable on the next request. A bypass is visible, not impossible |
Substitution is performed by the VGS proxy at the edge, never by Saifuro itself. We see aliases and verdicts, so primary account numbers stay outside our systems even on rails running in preventive mode. This is the same boundary described at the top of this page, applied to the settlement path.
Most deployments run both modes: preventive on the rails placed behind the edge, detective on the rest. Which mode applies to which rail is agreed during onboarding and stated per integration.
Preventive enforcement depends on egress placement. It holds while the agent has no second route to the provider, and confirming that is part of scoping.
We would rather tell you which mode you are getting on each rail than let the stronger one be assumed for all of them.
Certifications and audits
SOC 2 Type I completed 17 May 2026 with Schellman.
SOC 2 Type II observation period runs to November 2026; the report follows once the period closes.
Scope: policy engine, decision log, customer environments.
Type I confirms that controls were designed and in place at a point in time. Type II shows they operated over a period, so the observation window is stated here explicitly.
ISO/IEC 27001 certified by BSI. Scope: information security management system supporting the design, development, and operation of the Saifuro spend authorization platform, including supporting infrastructure and corporate functions. Certificate available on request.
PCI DSS. Card data is captured and tokenized by VGS, a PCI DSS Level 1 service provider, before it reaches Saifuro. Primary account numbers never enter our systems, which keeps our PCI scope to the minimum applicable to a service provider that does not store, process, or transmit cardholder data.
Certifications are listed at their real status, with the auditor, the period, and the scope. Attestations are published when they complete, not while they are in progress.
Reports and certificates are shared under NDA on request: [email protected].
If we have an incident
Customers are notified without undue delay and within 72 hours of us confirming a security incident that affects their data or their decision log.
Notification goes to the named contacts agreed at onboarding, not to a mailing list, and states what happened, what is affected, what we have done, and what we are still working on. Where the picture is incomplete we say so.
A post incident summary follows once the incident is closed.
Reporting a vulnerability
Write to [email protected]. We aim to acknowledge within three business days.
We do not pursue good faith researchers. Please do not touch customer data or disrupt live operations; if you need an environment to test against, ask and we will provide one.