Security
Your account, your keys, your record.
Vocion runs in your own AWS account or on your own host, under the controls your security team already runs. Records stay in your Postgres. Model calls go to the providers you choose. A self-hosted install has no Vocion control plane and does not phone home.
Deployment
AWS first. Or your own host with Postgres 16.
The reference deployment provisions the network, a host, Secrets Manager and DNS in your account with OpenTofu, then runs Vocion with Postgres, Langfuse and TLS on that host. Schedules and workflows run inside the app on its own Postgres. Agent turns can also run on Amazon Bedrock AgentCore Runtime.
Your AWS account or your own host
app · agents · schedules and workflows · the record
Postgres 16
pgvector · records, documents, durable jobs
Langfuseoptional
traces
OTel collectoroptional
metrics and logs
Caddy
TLS
On AWS: VPC · IAM · Secrets Manager
prompts, documents an agent reads, synced documents for search
Model providers you choose
Op
- Chat: Anthropic, OpenAI or Amazon Bedrock, per agent
- Search: OpenAI or Bedrock embeddings
- Rerank: Claude Haiku when an Anthropic key is set
the repo being built
Software Factory builds
- Claude Code · Anthropic
what you sync and send
Tools and channels you connect
SlTw- HubSpot, Gmail, GitHub, Slack, Resend, Twilio
traces
Langfuse Cloud, if you choose it
- Instead of the Langfuse on your host
Posture
The questions your security team will ask.
Short answers first. Each one comes from how the product works today, and the docs carry the detail.
Where secrets live
Connector credentials are encrypted with AES-256-GCM under a per-workspace key. Wrap that key with your own AWS KMS key, and grant the host role use of it. Runtime config sits in Secrets Manager and is written to the host at boot.
Where data is processed
Prompts and the documents an agent reads go to the model provider you choose per agent: Anthropic, OpenAI or Amazon Bedrock. Every synced document is embedded for search, by OpenAI by default or by Bedrock. Search reranking uses Claude Haiku when an Anthropic key is set. Software Factory builds run Claude Code, so the repo goes to Anthropic. Slack, Resend and Twilio carry the text of messages on those channels.
Where traces go
Langfuse runs beside the app by default. Point it at Langfuse Cloud or turn it off.
Who holds your data
Records live in your own Postgres. Connected systems keep their own copies. Operators with database or Langfuse access can read records, including assistant threads.
Who approved it
Every approval, edit and rejection is recorded with the person and the time. Automatic runs record the rule that let them run.
What it may do
Rules in trust.yaml and the Autonomy page set which actions wait for a person. A fixed list always does.
How replies are checked
Slack, email and SMS webhooks are signature-checked, and a reply decides only a card waiting in that thread, or about a record the thread follows. With several pending, Vocion matches your words to the newest one it names, and confirms which it decided. Email replies are matched by sender address and rely on your domain's DMARC enforcement, so use the app or Slack for protected actions.
How to stop it
A running mission or workflow can be cancelled from the app.
What changed
Agents, teams and rules are YAML in git. Each workspace apply is versioned, and builds, missions and workflows record the version that ran.
What you can audit
The source. Vocion is open source under MPL-2.0, so your team can read every line.
Control
Autonomy is set per action, and recorded.
An action either waits for a person or runs on its own above its confidence bar. Small changes that can be undone can run on their own by default, each listed with Undo. Some plugin rules run on their own too, such as merging a pipeline fix. If someone rejects or undoes work an action did on its own, it steps down a level and is flagged for review. Sending email and connecting a new data source always wait for a person.
Small changes that can be undone start here
Rejected or undone after it ran on its own? It goes back to waiting for a person and is flagged for review.
Waits for a person
A person approves each run.
Runs on its own
Runs above its confidence bar. Below it, waits.
Waits for a person
A person approves each run.
An admin lets it run on its own
Rejected or undone after it ran on its own? It goes back to waiting for a person and is flagged for review.
Small changes that can be undone start here
Runs on its own
Runs above its confidence bar. Below it, waits.
Always asks
Built in. No rule or promotion changes it.
Set per action, in each workspace.
The Autonomy page lists each action with its setting. The CRM update runs with Undo, the chat post waits for a person, and sending an email from your mailbox always asks.
Certifications
On certifications, plainly.
SOC 2 and ISO 27001 certify the operator of a hosted service. Vocion is software you run, so the controls that govern your deployment are your own, which is where your auditors want them. If Metacto runs Vocion for you, ask us for our controls and access policy. What Vocion adds is the record an audit asks for.
Every run recorded
The steps, the tools called and who approved it. Each chat turn, mission and build records its cost.
Every approval named
Customer-facing work links to the person who approved it.
Every change versioned
Each workspace apply is versioned, and changes made in the app are recorded in Vocion.
Get started
Walk your security team through it.
We will run Vocion in a sandbox account, show where every credential, trace and record lives, and answer the questionnaire with the source open.
For your team: a demo built around your job, on sample data.
For your engineers
Run it yourself
The requirements, the AWS path and the repo.