Security and trust
Where Ares runs, what it stores, how the record works, and what we keep for the conversation under NDA. Written for the security architect who has to approve it.
Three shapes. Same product.
Pick the one your data rules allow. The record works the same way in each.
Azure SaaS
Transactable on the Azure Marketplace, Entra ID native. The fastest way to a governed workflow.
Hybrid
Your agents and data stay in your environment. Ares governs them where they already run.
On-prem and disconnected
Any Kubernetes in your building, with or without a connection out. A whole site runs on one small machine at 20–25 W.
How each shape worksIdentity
Every agent gets its own identity, issued from your directory. Ares is Entra ID native: people sign in with the accounts they already have. Each agent carries a badge that says what it may do for this job, and for how long. The permission narrows at every handoff, so a downstream agent never holds more than the one that called it.
Data residency
On Azure SaaS, your tenant runs in the Azure region agreed for it. On hybrid, your agents and their data stay in your environment. On-prem and disconnected, nothing leaves your building, including the record.
What we store
- The record of each decision: which agent acted, for whom, what the badge allowed, what was refused or redacted and why, and when.
- Your configuration: policies, roles and permission rules.
- Account and billing details for the subscription.
- Support messages you send us.
What we do not store
- The content of prompts, model outputs or documents, unless you turn on retention for audit.
- Passwords or secret tokens. Ever.
- Content a filter is told to keep out. The record can hold only a fingerprint of it, so you can prove what passed without keeping it.
The audit model
Every decision, including every refusal, is written as it happens into a record nobody can quietly edit. A refusal names what was outside the badge. A redaction names the filters that fired, the session that allowed the exchange, the parties and the time. Steps that need judgment are sent to a human for review, and the decision is written down too.
When an auditor asks what an agent did, you replay the record. You do not reconstruct it from logs and memory.
What we don't disclose publicly
We do not publish the internals of the record, our network topology, host names, or the names of customers who have not agreed to it. That is deliberate: it is the first thing an attacker would want. Under NDA we walk your security team through all of it, with the architecture and the evidence behind each claim on this page.
Identity tells you who. Ares decides what each hop may do.
Identity tools and observability tools are both useful. Neither stops an agent at the door and keeps the record of why.
| Identity-only tools | Observability-only tools | Ares | |
|---|---|---|---|
| An identity for every agent | Yes | No | Yes |
| Permission narrowed per job and per handoff | Partial | No | Yes |
| Out-of-badge actions refused at the door | Partial | No | Yes |
| Content inspected on the way in and out | No | Partial | Yes |
| Steps sent to a human for review | No | No | Yes |
| A record nobody can quietly edit | No | Partial | Yes |
| Runs on-prem or disconnected | Partial | Partial | Yes |
| Works across vendors over A2A and MCP | Partial | Yes | Yes |
Categories, not products. Individual tools vary; ask us for a comparison with the one you run.
What security teams ask first.
Walk into the review with the record, not a promise.
The security pack covers the architecture and the evidence. We send it after a short NDA.