Security

Pazi combines account authorization, isolated agent computers, scoped runtime access, encrypted credentials, and restricted content rendering. These controls reduce risk, but safe use still depends on the permissions, data, and actions you give an agent.

Sign-in and sessions

Public accounts sign in through available OAuth providers such as Google, Outlook, Apple, GitHub, LinkedIn, Facebook, or X. There is no public password registration.

Pazi uses an opaque server-side session in a protected browser cookie. Dashboard resources are ownership-scoped unless a specific agent or business collaboration rule grants access.

Agent-computer isolation

Each conversation runs in its own isolated cloud computer. Conversations for one agent can use that agent's durable workspace, while another agent does not automatically receive its private workspace or private memory.

Business agents share only the business-scoped memory and user-facing created files intended for collaboration.

Scoped runtime access

Agent computers do not receive your browser session cookie or Pazi's broad model-provider keys. Pazi gives a run a short-lived, purpose-scoped identity and rechecks access when it calls approved platform routes.

Pazi-billed model traffic goes through Pazi for funding checks, provider routing, and usage attribution.

Saved credentials

Third-party credentials are encrypted by the API and scoped to one user and business. They are injected only into a fresh run process, are not returned to the browser, and are redacted when agent-influenced content leaves the runtime.

All agents in the same business can receive that business's saved credentials. Review business membership and agent roles before saving a powerful secret. See Integrations & credentials.

Files and share links

The underlying file bucket is private. Dashboard previews require your Pazi access. A public share allows anyone with the tokenized link to open the staged file; a private share requires a signed-in allowed email or applicable agent access.

Agent-authored HTML reports and dynamic pages render in a restricted iframe that cannot read the Pazi session cookie or app storage. In-page actions use a limited allowlist and do not directly perform sensitive operations.

Project data storage

Pazi stores the durable information needed to continue your work. This includes Business DNA and shared memory, agent workspaces and private memory, generated documents, code, images, and other created files, conversation messages, and run state.

Project data is split across Pazi-controlled cloud systems according to its purpose. Agent and business files use durable provider-backed storage; generated media and dashboard-ready file copies use private object storage; product records such as conversations and run status use Pazi's application database. These systems are operated for Pazi with cloud and infrastructure providers—they are not limited to physical servers owned by Pazi.

Model processing and training

When an agent performs a task, Pazi sends the relevant instructions and context to the selected model provider to generate a response. Depending on the selected model and runtime, that provider can be Anthropic, OpenAI, or Amazon Bedrock.

Pazi does not use your Business DNA, project files, or agent outputs to train or fine-tune models. Pazi also does not opt customer project data into voluntary model-provider training programs. The commercial and API services Pazi uses state that customer inputs and outputs are not used for model training by default. See the current data-use information from Anthropic, OpenAI, and Amazon Bedrock.

Pazi may use limited technical logs and product analytics to improve service reliability, performance, security, and user experience as described in the Privacy Policy. That product improvement is separate from training a model on project content.

Export and deletion

You can preview and download individual files from All Docs → Files. Pazi does not currently provide a one-click export containing every file, conversation, and account record. Contact support when you need an account-level data access request. See Files and reports for file downloads.

You can delete ordinary files from the Files page, permanently delete an owned business from its controls, or request full account deletion from Account → General. Business and account deletion remove active Pazi records and durable runtime storage; full account cleanup runs asynchronously and retries provider cleanup before removing the final account record.

Deletion cannot recall copies that another person already downloaded. It also does not promise immediate erasure from every backup or from records Pazi must retain temporarily for security, billing, dispute resolution, or legal obligations. See the Privacy Policy for the current retention terms.

Encryption at rest

The durable file stores used for Business DNA, agent workspaces, created files, generated media, and staged file copies encrypt file data at rest. Archil-backed workspace storage uses AES-256 encryption at rest, and Amazon S3 applies server-side AES-256 encryption to stored objects by default.

Encryption at rest complements—rather than replaces—Pazi's private buckets, scoped runtime identities, ownership checks, and access-controlled previews and downloads.

Web and prompt injection

Web pages, files, and emails are untrusted inputs. They can contain text designed to manipulate an AI agent.

Pazi provides browsing controls, isolated computers, scoped credentials, and model-level safeguards. For higher-risk work, use a web-research agent without sensitive internal connections and pass reviewed findings to a separate internal agent.

Inbound email

Unknown inbound mail is stored without automatically starting a credentialed run. Automatic processing requires an authenticated trusted relationship, such as a validated reply to a thread the agent started or a known contact.

Pazi marks inbound content as untrusted data before it reaches the model and limits agent-to-agent reply loops. You should still inspect unusual attachments, identity claims, and financial or credential requests.

Slack and team access

Slack routing requires an installed workspace, an enabled agent handle, and channel access. Private channels must also include the Pazi app.

Business membership is scoped to one business. Admins can manage that business's members; members do not gain access to the owner's other businesses, billing, or protected account mutations. Business-agent usage is billed to the owner.

Transparency and review

Use Live View, chat history, file previews, opportunity status, run errors, and channel history to inspect what happened. Generated content and agent confidence are not substitutes for independent verification.

Report a suspected vulnerability privately through Contact and avoid posting exploit details in a public channel.