Security model
What Cresec guarantees, what it doesn’t, and how to check.
Guaranteed, when calls go through Cresec
- In a Cresec tool, recipients and targets come from sources set in code, never from model output.
- The tool holds no app or model keys; the gateway uses the person’s connection, or the workspace’s model key, for an approved call.
- Calls routed through Cresec produce signed activity records.
- If the control service is unavailable, calls stop.
Not guaranteed
- The words in a draft. A fooled model can still write something wrong, which is why drafts and per-person grants exist.
- Data the model sees for a slot can show up in that slot’s text.
- A stolen user session or a compromised app account. Those are your identity provider’s and the app’s controls.
- Activity that bypasses Cresec, such as someone using the app directly.
Threat model
| Threat | Covered | How |
|---|---|---|
| Injected text changes the action | Yes | Actions are fixed in code |
| Injected text changes the recipient | Yes | Recipients and targets come from sources set in code |
| Injected text plants misleading words in a draft | Partly | New users can draft but not send |
| A stolen user session | No | Your identity provider’s controls |
Records
Calls routed through Cresec produce signed activity records. Requests are hashed and records use redacted metadata rather than a store of full payloads. Your connected apps and models still process the data needed for the task.
Record integrity and activity coverage are separate checks. Verify the records supplied, review missing or unknown outcomes, and resolve an uncertain write before retrying it.
Where data goes
Each model slot runs at a model provider, through your workspace’s own key.
Verify it yourself
The open-source verifier checks a bundle offline with Node.js alone. Try it on a sample evidence bundle, intact and tampered, recorded 2026-10-08 at 21:54:31 UTC with @cresec/mcp-recorder 0.2.0 verify.cjs. To report a vulnerability, see our disclosure page.