harnyData protection and tracing to source
Data is encrypted in transit, kept inside the app it belongs to, and traceable to the source it came from.
Security
Security for enterprise review
Harny keeps each app's data apart, checks every request against the app that sent it, and records every action an agent takes. Written answers to a security questionnaire and a summary of the security measures are available on request.
At a glance
Scoped credentials
API keys are stored only as one-way hashes, shown once and revocable at any time. Every request passes one authentication layer.
A record you can check
Every action is sealed into a numbered record. An export shows whether anything is missing or altered.
Reviews and agreements
Controls by SOC 2 category
Harny lists its security controls under the five category names of SOC 2's Trust Services Criteria: Security (one sign-in layer, API keys stored as one-way hashes and revocable at any time, every read scoped to the calling app, and the app's acting settings enforced on Harny's servers), Availability (rate limits and daily quotas that keep counting when a supporting service is down), Processing Integrity (a numbered, hash-chained action record you export and verify, and one error format on every route), Confidentiality (credentials encrypted before storage, credential-like strings removed before a model sees content, and fetched source copies deleted on a schedule) and Privacy (delete any stored item with the memories that rest only on it, and a retention schedule for children's data).
Data agreement and roles
The business and Harny are joint controllers for collecting users' data through the business's app, and the agreement says who answers each request from a user.
Written security answers
Written security answers and a security questionnaire are available on request through support@harny.ai with Security in the subject.
How Harny handles your data
Encryption in transit and for credentials
Connections use TLS. The tokens users grant for connected accounts, and the secrets that sign webhooks to you, are encrypted at rest in the application. The encryption keys can be rotated.
Source retention and deletion
One erasure path removes a user's data across every store that holds it, and an automated test checks that it is complete. Erasure finishes within 30 days. You can delete a single stored item. A deleted record keeps its numbered place with no content.
Apps are isolated
Every read is scoped to the calling app. A request for another app's or another user's item returns "not found". Stored source content never crosses from one app to another.
Before a model sees content
Strings that look like credentials are removed before content goes to a model provider, and lines in email content that try to instruct the agent are removed.
Restricted production access
People at Harny do not read the content of users' connected accounts except with the user's consent, for security or where the law requires it, and production access is limited to a few named engineers with multi-factor sign-in and logging.
Identity and access
API key revocation
The business can revoke an API key at any time. Keys are shown once, when created, and stored only as one-way hashes.
One sign-in layer
Every request is resolved through a single authentication layer.
Actions stay inside the owner's settings
The app's acting settings are enforced on Harny's servers, not in the agent. An action that needs a confirmation never runs without it, and a confirmation runs the action once, exactly as confirmed. Actions are rate limited per user and per kind of action.
Operations
Where it runs
Data stored in the US. Model providers follow the app's model setting.
Traces and tooling
Operational traces are cleaned of content before they are stored. Administrative tools are deployed separately from the customer-facing service, and a build check keeps customer-facing code from importing them. The host exposes only web traffic and administrative access, behind an edge network.
Incident notice
Harny tells the business without undue delay after it becomes aware of a security incident affecting the business's users. The notice says what Harny knows: what happened, how many users and records, the likely consequences, the measures taken and a contact. Harny makes the regulator notices the law requires of it.
Frequently asked questions
01How does Harny handle data-protection law?
The business and Harny sign a data agreement. It sets who is responsible for what, who answers each kind of request from a user, and how an incident is reported. For users the business flags as children, Harny works only for the business.
02Does Harny use my data to train AI models?
No. Harny does not use your data to train general AI models. That covers data from a Google account and everything else you store with Harny.
03How is data deleted?
Delete a single stored item, or ask for a user's data to be erased. One erasure path removes the data across every store, and it finishes within 30 days.
04Can I audit what the agent did?
Yes. Every action is written to a numbered record; each entry carries a hash of the one before. Export it as JSON or CSV and verify that nothing is missing or altered. A record removed by an erasure is counted, not hidden.
05Can I leave?
Yes. Delete any data point, erase any person across every store, export the action record, and export a person's memory.
06Where does Harny run?
Data stored in the US. Model providers follow the app's model setting.
07How do I get a security questionnaire answered, or the data agreement?
Write to support@harny.ai with Security in the subject. Harny gives written answers to a reasonable security questionnaire (once in any 12 months) and a summary of its security measures. The data agreement is available on request.
08How do I report a vulnerability?
Write to support@harny.ai. Security reports are read first.