Your data, your rules.
Astry runs inside your own cloud, on infrastructure you own. Permissions inherit from your source systems. The model only ever sees the files the asker is cleared to see, enforced at the operating system, not by a prompt.
The agent has only these read-only tools, and they see only the sandbox — no access to the real vault or the network.
A physical copy, not a link — the sandbox holds no pointers to the real vault. The agent cannot read a discarded file: it does not exist for it.
full cycle: 4.2 sEvery candidate file resolved to authorized or denied, per request
Four properties that hold on every request.
Security is not a setting you switch on. It is how Astry is built. These four properties are true before the model reads a single file.
Runs in your cloud
OS-level isolation, not prompt filtering
Permissions inherit from your systems
Astry never sees your content
Five deterministic steps before the model runs.
The hard part happens before inference. By the time the model reads anything, the only files in front of it are the ones the asker is cleared to see.
- 01
Verify identity
Astry resolves every request to a known user through OIDC SSO with your identity provider before anything else runs.
- 02
Compute the cleared set
Hybrid retrieval seeds up to roughly 200 candidate files, then the access-control layer applies your file-level ACL and keeps only what this asker is cleared to see.
- 03
Project into a sandbox
Only the cleared files are copied into a fresh per-request sandbox under /tmp. Real copies on the filesystem, never symlinks, and a manifest lists only those files.
- 04
Run the model, scoped
The model runs with that directory as its entire world. Path validation rejects any escape, so it cannot reference or even discover a file it was not given.
- 05
Audit, destroy, return
Every query, resource, action, latency and cost is written to an append-only log. The sandbox is deleted in a finally block, then the answer returns.
The facts.
No marketing claims. The controls a security team checks first, stated plainly.
- Encryption in transit
- TLS in transit over HTTPS for every call into Astry and out to model hosts.
- Encryption at rest
- AES-256-GCM, authenticated so tampering is detected. A versioned envelope with a key id, rotated through a keyring without re-encrypting data. Keys from your KMS, or in BYOC a key only you hold.
- Authentication
- OIDC SSO with your identity provider — Okta, Microsoft Entra ID or Google Workspace, with directory provisioning.
- Access model
- Four workspace roles. File-level ACL from document frontmatter and a database trust policy. Missing membership means no access, enforced fail-closed.
- Retrieval isolation
- Cleared files are copied into a per-request sandbox; everything else is physically absent, not just hidden. Path validation rejects escape; the request fails closed.
- Audit log
- Append-only WORM. The app database role has INSERT and SELECT only — UPDATE and DELETE are revoked at the database. Dual-written to JSONL and Postgres.
- Anomaly detection
- Built-in anomaly detection on usage, with optional SIEM forwarding.
- GDPR
- DSAR and departure-kit tooling for retrieval and erasure of a user's data.
Explore the controls.
Each guarantee has its own page, with the mechanism in full.
Access control
DLP at ingest
Encryption at rest
Sovereign egress
Audit
BYOC
Where we stand.
An honest snapshot. What is shipped today, and what is on the roadmap.
EU residency
SOC 2 Type II
ISO 27001
GDPR Art. 17
The only third parties are the ones you choose.
Astry holds no customer data. Every party that touches your environment is one you already trust.
- Your cloud provider
- Compute, storage and KMS in Azure, GCP or AWS, in the region you choose.
- Your identity provider
- Authentication through Okta, Microsoft Entra ID or Google Workspace.
- Model routing (optional)
- Route to EU-only hosts behind the egress guard, which blocks any host off your allowlist. Off by default until you enable it.
- Local inference (optional)
- Ollama for fully local, air-gapped deployments, with no outbound model calls.
Bring your security team into the conversation.
We answer the hard questions in detail. Send the email, or book a call with the engineers who built the Trust Layer.