Trust

Control is built in.

Define what agents can do, who can operate them, and how your data is handled. Test before launch. Review what happened afterward.

Book a DemoStart nowBuilt for HIPAABAA available
On this pageAgent controlsData architectureIdentity & accessSecurity & compliance
Agent Controls

Set the boundaries.

Approved actions, escalation, testing, and reviewability. You define what agents can do — the platform enforces it, and every step stays on the record.

Control what agents can do

The right person stays in control.

Each agent takes only the actions you've permitted. Escalation is explicit — a sensitive conversation, a frustrated caller, or a request outside scope routes to a person with the full thread attached, so whoever takes over never starts cold.

Permissions & escalation
Scheduling & remindersAgent handles
Benefits & cost questionsRequires approval
Sensitive requestHuman takes over
Builder accessRole-based
Escalation: full thread attached · routed to on-call role
  • Define approved actions — agents take only the actions you allow; independence is opt-in per step.
  • Define when humans take over — you set the triggers and routes for handing a conversation to a person.
  • Test behavior before launch — validate coverage and escalations in a sandbox; nothing goes live until your team signs off.
  • Review every conversation and action — a full, reviewable history your compliance team can follow.
Data Architecture

Your data stays separated by design.

Every workspace runs in its own isolated database. Data is encrypted in transit and at rest. Access is scoped by role, and every action is reviewable.

Every workspace runs in its own isolated database — never commingled, even inside your own organization. The organization is the trust boundary your security team governs: SSO policy, membership, roles, and billing in one place.

Identity & Access

Your organization controls the front door.

A Gravity Rail organization is one governable trust boundary — your security team decides who signs in, how, and with what role, across every workspace.

  • Enterprise SSO (OpenID Connect) — Microsoft Entra ID, Google Workspace, Okta, Auth0, or any standards-compliant OIDC provider, with tenant and domain validation.
  • Enforceable login policy — per organization: open, SSO required for your domain, or SSO-only with password login disabled.
  • Two-factor and hardware keys — authenticator-app 2FA, WebAuthn hardware keys, and step-up authentication for sensitive actions.
  • Role-based access control — organization and workspace roles govern who can administer, build, approve, and operate; API access is scoped the same way.
Security & Compliance

Built for sensitive data.

Gravity Rail supports the controls organizations expect when patient information is involved.

  • HIPAA-aligned safeguards
  • BAA available
  • Encryption in transit and at rest
  • Role-based access
  • Audit history
  • Security documentation available
⚿Your data stays yours.Gravity Rail uses zero-data-retention model configurations for production workloads. Your data is not used to train shared models, and your workflows, protocols, and configuration remain yours.
⇲Take it with you.Export your workspace configuration, workflows, and protocols. Remove integrations or models, and delete your workspace when you are done.

Features and workspace flags do not establish compliance status — PHI posture, contractual coverage, and service configuration are confirmed with each customer during security review. To request current documentation or a BAA, contact security@gravityrail.com.

Bring your security team.

We'll walk through the architecture, controls, data flows, and current documentation with your protocols in view.

Book a DemoExplore the Platform