What is verified, and what is not yet

Every line on this page is either checked in code today or stated plainly as not done. Nothing in between.

10Verified today

3Not yet

Verified today

Checked in code

Identity and access

Local passwords are hashed with argon2id, and no default administrator password ships with any deployment.
Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.
OIDC sign-in uses PKCE, nonce and state, and hands the session over with a one-time cookie-bound code — never a bearer token in a URL.
Per-IP rate limits protect the login endpoint against brute-force attempts.

Audit and policy enforcement

Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Changing a host's execution policy from read-only to full is an administrator-only action.
Per-IP rate limits also protect host enrolment against abuse.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.

Signed skills and rollback protection

Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.
The signed vendor skill feed is rollback-protected: an older signed catalogue cannot replace a newer one.

Not yet

Stated plainly

An independent security audit has not yet been completed.
A third-party penetration test has not yet been run.
Installers are not yet code-signed or notarised for macOS and Windows.

For Saudi enterprises: see how these controls map to NCA ECC-2:2024 and PDPL requirements.

Control mappings and enterprise evaluation

How AcTree supports your controls

Framework	Area	How AcTree supports it
NCA ECC-2:2024	Identity and access management	Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment. OIDC sign-in uses PKCE, nonce and state, and hands the session over with a one-time cookie-bound code — never a bearer token in a URL.
NCA ECC-2:2024	Cybersecurity event logs and monitoring	Administrative actions — such as raising a host's execution policy or moving a host between workspaces — are recorded to an audit log with the actor, the action, the subject and the values before and after the change.
NCA ECC-2:2024	Asset and configuration management	Host investigations show the commands that ran, their exit codes and output, per host.
NCA ECC-2:2024	Change management	Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice. Changing a host's execution policy from read-only to full is an administrator-only action. Execution follows the configured host policy. A command can be approved, denied or referred for human review; individual approval depends on that policy.
PDPL	Where personal data is processed	Customer-controlled inference and execution boundaries. Customer-hosted deployments use packaged deployment configuration. An offline deployment requires an accepted bundle, local model and disconnected installation tests.
PDPL	Protection of stored secrets	Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
SAMA CSF	Third-party and supply-chain risk	Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one. The signed vendor skill feed is rollback-protected: an older signed catalogue cannot replace a newer one.

Compliance stays your organisation’s own work. AcTree gives your teams controls and evidence that support it; it is not a certification.

Evaluate controls on your chosen release

Command review

Test permitted reads, a denied action and any action requiring human review. Record the host policy and actual disposition. Automatic command-risk review does not establish document DLP.

Evidence for IT and security

Inspect the host, command, exit status and output behind a finding. Record unknowns and reviewer decisions. Demonstration data is not an independent security assessment or a customer incident.

Identity and assurance scope

Confirm identity for the agreed deployment and obtain the actual assurance evidence relevant to your requirements. Do not infer hosted workspace SSO, Windows support or a completed external assessment from a different configuration.

Bring one question of your own.

Book a technical briefing Start free trial