Trust
Why you can trust Scopebond with your agents
You're handing a product control over what your AI agents may do. That deserves plain answers: how we protect you, what our product does and doesn't claim, and who we are.
Autonomy is earned through accountability.
Authority should be explicit, actions should be verifiable, and failures should be recoverable. That is Avouro's operating principle, and Scopebond is that principle, shipped.
How we protect you
Your rules run in your environment
Enforcement happens on your machines or your cloud. We never hold a credential that can move your money or act on your systems. Our service holds only signed records.
Records carry no sensitive data
No prompts, no file contents, no personal data. Only identifiers, the amounts your rules name, and cryptographic fingerprints. Secrets are scrubbed before anything is signed.
Fails safe, and it's open
If anything is unclear, the answer is "no." The gateway is open source under Apache-2.0, so anyone can inspect exactly what it does, and it never phones home.
Proof anyone can check
Records are signed and verify against published keys, offline. Each one says how strong it is: signed by the agent, authorized at a checkpoint, or recorded at a boundary. Never more.
Your data, your account
The workspace uses Google, Microsoft or GitHub sign-in; each person keeps individual access; every privileged action is logged. Export or delete your records when you choose.
Mapped to recognized standards
Implemented controls are mapped, narrowly and honestly, to NIST CSF 2.0 and SP 800-53 references, with what's ours and what's yours spelled out. No compliance score, no badges we haven't earned.
Our product, honestly
The open-source gateway enforces real rules, signs real records and has a kill switch. Records verify offline. The live demo at try.scopebond.com makes real decisions with no side effects.
Scopebond is an experimental alpha for controlled test use. Use it with test systems first. The Cloud workspace is a reviewed beta: Scopebond Cloud is not production protection, and billing is disabled. Each integration is labeled with what it can truthfully prevent; unfinished ones are shown as planned.
No "100% compliant," "zero risk" or "court-ready." No certifications we don't hold: there is no SOC 2 report and no third-party penetration test yet. A record proves what was requested and decided, never that a business result happened.
This page describes the controls we operate today. It is not a certification, audit report, SLA, legal advice, or contractual security commitment. Contractual terms come with a signed agreement.
Who we are
Scopebond is made by Avouro, a technology company built for responsibility. Avouro studies how to make autonomous and AI systems safe, verifiable and accountable, and turns that research into infrastructure people can actually run: open source where openness makes it more trustworthy, supported where teams need it.
Our operating principle is that human judgment stays in control: authority is declared, not assumed; every action leaves proof; and when trust is misplaced, there is recourse.
Avouro LLC · Michigan, USA · avouro.com · [email protected]
Fail-closed defaults, tamper-evident records, least privilege. First principles, not features.
A named person is responsible for every agent; rule changes are reviewed by a colleague.
We publish what's true, what's gated and what we won't promise, on this page and in the product.
Reporting and disclosure
Email [email protected] or use the details published at /.well-known/security.txt. We acknowledge every report and coordinate a fix before disclosure. Scopebond does not currently operate a paid bug-bounty program.
Cloudflare for hosting; Resend for access-request email; PostHog for product analytics. No session replay on sensitive screens, and no third-party pixels.
Nothing on this site is an offer of insurance, securities or financial services, or legal or financial advice. Scopebond is a trademark of Avouro LLC.