# Trust & Security — What ACP Sees, Stores, and Can Never Do

ACP sits in your agents' call path, so you deserve precise answers: what we see, what we store, what happens if we disappear, and how we run security. Plain language, no badges we haven't earned.

# Trust & security

ACP sits in your agents' runtime call path. That's the whole point — and it's also exactly why you should ask hard questions before routing production through anyone, including us. This page answers the seven we'd ask.

---

## 1. What ACP sees and stores

Every governed call writes one audit record. **By default that record is metadata, not content:** the tool name (`Read`, `Bash.git`, `WebFetch.example.com`), the acting identity, the policy decision and which rule made it, timestamp, latency, token counts and metered cost, the harness and its version, the working directory, session and call ids, the agent name, task label and delegation chain your harness reports, your email, the human-readable reason for the decision, and for web tools the hostname. If you enable PII scanning, the record also notes which PII *types* were seen — never the values.

**Request and response content is off by default.** Turning it on is a per-workspace choice on the console's Logging page — *Include inputs* and *Include outputs* — and when on, previews are truncated to 1,500 characters; if your policy is set to redact or block, PII the scan finds is removed from the call's decision record before it is written. Off means the field is absent from the record, not present and empty.

**One exception, and we would rather name it than have you find it:** when a policy requires a human to approve an action, up to 500 characters of that action's arguments are stored with the approval request, so the approver can see what they are approving. That preview is not PII-redacted, it is included in the approval email or push sent to approvers, and the request record — preview included — is kept until the workspace is deleted.

- **See exactly what we hold for you** at any time: `acp_audit` from your agent, or the [activity log](https://cloud.agenticcontrolplane.com/activity).
- **`--local` mode keeps everything on your own disk** — no account, policy evaluated on-device, nothing leaves your machine at run time (the installer downloads the hook once). `curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --local`.
- **Your connected credentials** (OAuth tokens for GitHub, Slack, etc.) are encrypted with AES-256-GCM under KMS-managed keys, stored per user, per workspace.
- **We never train models on your data, and never share it for training.** Full detail in the [Privacy Policy](/privacy).
- **Audit records are kept for 12 months**, then deleted by an hourly job; Enterprise workspaces are kept indefinitely. Approval requests and session summaries are removed when the workspace is deleted. You can export session and agent data as CSV from the console.

The short version: we designed ACP so that trusting us requires trusting us with as little as possible.

## 2. What the installer writes to your machine

The installer puts a hook in front of every tool call your agents make. That is an intrusive thing to do, so here is the complete list, with no "and related configuration".

**Shared, once:** `~/.acp/` — `govern.mjs` (the hook, [readable source](https://github.com/agentic-control-plane/claude-code-acp-plugin/blob/main/bin/govern.mjs)), one small shim per harness, the launchers, and `credentials` (your workspace key, `chmod 600`). Plus one marked line adding `~/.acp/bin` to `PATH` in your shell rc.

**Per harness we detect:** a `PreToolUse` / `PostToolUse` hook entry in that harness's own config (`~/.claude/settings.json`, `~/.cursor/hooks.json`, `~/.codex/hooks.json`, …), and an `acp` entry under `mcpServers`. Existing entries in those files are preserved — we merge, never overwrite.

**Instruction text, and we want to be blunt about this:** we append a block to your agent-instruction files — `~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, and the equivalent for other harnesses. It tells your agent to launch through `claude-acp` so model calls get priced. It is fenced in markers so you can find every instance:

```
<!-- acp:begin — Agentic Control Plane governance -->
…
<!-- acp:end -->
```

We append between those markers and never touch anything outside them. `grep -rl "acp:begin" ~` finds every one. We do not write into your project repositories — only into per-user config directories.

**Harnesses we did not detect can still be governed.** Several agents (Grok Code on Windows among them, where we do not yet wire it directly) read Claude- or Cursor-format hook configs for compatibility. If you have one of those, registering a hook for Claude Code or Cursor also governs it, and its calls appear in your audit labelled with the config they read rather than their own name. We would rather say this here than have you find it in a log.

**Removal is one command, and it ships with the install:**

```
acp-uninstall              # or: curl -sf https://agenticcontrolplane.com/uninstall.sh | bash
acp-uninstall --dry-run    # show what it would touch, change nothing
```

It removes the hook entries and leaves your other hooks, strips the marker-fenced blocks and leaves everything you wrote around them, drops the MCP entries, the `PATH` line and `~/.acp` — registrations first, so nothing is ever left pointing at a file that is gone. The script is cached on your disk at install time, so getting out never depends on us being reachable.

Your workspace and its history live server-side and are **not** deleted by removing the client. Deleting them is self-serve, under Settings → Your data in the console: export your data, delete a workspace, or delete your account outright — no request to us, no waiting on our approval. Deletion is permanent; we keep no backups of workspace data. The [privacy policy](/privacy#7-your-rights) sets out what each one removes and what survives.

## 3. What happens when ACP is unreachable

It depends on who is at the keyboard, and the hook decides that from the harness's permission mode:

- **An interactive session fails open.** If the API is down, slow, or your key is rejected, the call is allowed and runs ungoverned; the hook says so in your session, writes the lapse to `~/.acp/lapse.log`, and reports it on the next governed call so the gap shows in your audit trail rather than disappearing. An outage of ours must not become an outage of yours.
- **An unattended agent fails closed.** Background, subagent and API-tier calls are denied while policy cannot be consulted. Those are exactly the sessions with no human watching, and "run ungoverned until someone notices" is not an acceptable posture for them.
- **A few floors apply either way.** Catastrophic commands — recursive deletes outside the working directory, force-pushes, piping downloads into a shell, destructive SQL — are stopped or asked about by the hook itself, offline, in every tier.

There is no switch to change this posture. One consequence worth knowing: harnesses run with permissions bypassed (`bypassPermissions`, `always-approve`) are treated as unattended, so a person driving an agent that way is in the fail-closed group.

## 4. What happens if we disappear

The uncomfortable question about any young vendor — so we answered it with architecture instead of promises:

- **The enforcement layer is open source.** The governance modules (identity, policy, limits, redaction, audit) are MIT-licensed npm packages. They run in your infrastructure, with or without us.
- **Self-hosting is a supported path,** not an enterprise upsell.
- **Your audit data is exportable** (CSV today, API always).

If we vanished tomorrow, your control plane keeps running and your data comes with you. Very few vendors in this category can say that; it's the reason we built on open source.

## 5. Is anyone actually using this?

Yes — starting with us, on purpose. **Our own production agents route every tool and model call through ACP.** The counter on the [homepage](/) is a re-counted Firestore total of every call the gateway has recorded, ours and external, with its count date beside it. We publish what we learn from running it — a [teardown of one dogfood window](/blog/one-step-90-percent-of-our-agent-bill), [what 285,000 of our own calls actually cost](/blog/what-280k-agent-tool-calls-look-like), and the [loop tax it exposed](/blog/the-loop-tax) — and every number on [/data](/data) carries its snapshot date. We'd rather show you our audit trail than a logo wall we haven't earned yet.

## 6. Security posture — what's true today

What we do:

- **Policy enforcement on every governed call**, scoped to the acting user's identity — audit-only (allow and log) by default, deny-by-default once you configure it.
- **Encryption in transit (TLS) and at rest** (Google Cloud infrastructure, us-central1); application-level AES-256-GCM for stored credentials.
- **No passwords stored** — authentication is delegated to Firebase Auth / your identity provider.
- **Privacy-first analytics** (self-hosted Plausible — no cookies, no cross-site tracking) on our own sites.
- **Secret-scanning gates on our own code**, and least-privilege keys for our own vendors. We hold ourselves to the model we sell.

What we don't have yet — said plainly:

- **We are not SOC 2 / ISO 27001 / HIPAA certified.** What ACP provides today is the evidence layer those frameworks ask for: identity-attributed logs of every agent action, policy decisions, and redaction findings — audit exports built to serve as evidence in your own certification work.

Found a vulnerability? See [/.well-known/security.txt](/.well-known/security.txt) — or email [david@agenticcontrolplane.com](mailto:david@agenticcontrolplane.com). We don't shoot messengers.

## 7. Who's behind this

I'm [David](https://www.linkedin.com/in/mrdavidcrowe). I built ACP because my own production agents needed it: I wanted to see, control, and price every action they took, and nothing off the shelf sat in the call path and did all three. My agents have run through it ever since — every call on that homepage counter includes mine.

If you're evaluating ACP for a team, I'll answer the hard questions directly: [book 30 minutes](/call) or email [david@agenticcontrolplane.com](mailto:david@agenticcontrolplane.com).

---

**The paper trail:** [Terms of Service](/terms) · [Privacy Policy](/privacy) · [What is an Agentic Control Plane?](/what-is-an-agentic-control-plane) · [Pricing](/pricing)