Three trust boundaries, architecturally enforced. Your data plane is yours. The LLM inference path is your direct relationship with your provider. Every MCP tool call runs as the authenticated user — an agent can never do more than the user calling it. Every guarantee is built into the system architecture and contractually backed — not documented in a slide deck.
Axon separates concerns into two distinct planes with a technically enforced trust boundary. We manage the orchestration. You keep the data. All communication is agent-initiated — no inbound ports, no tunnels, no reverse proxies. The data plane separation is enforced by code, not policy.
Managed by Ultrathink
Stores
Never Stores
Trust Boundary
Your VPC
gRPC over TLS 1.3. Agent-initiated polling. Zero inbound access from Ultrathink.
Four guarantees that your data plane stays yours — technically enforced, contractually backed.
Your secrets never touch our infrastructure.
The control plane stores variable names — never values. Config var values flow directly from your CLI to K8s Secrets in your cluster. Platform-generated credentials (per-app database passwords) are created locally by the agent. Even a complete control plane breach exposes zero customer credentials, because there are none to expose.
Designed after WarpStream and ClickHouse Cloud BYOC zero-access models.
No SSH. No kubectl. No shell access. No tunnels.
All communication is initiated by the Axon Agent inside your VPC. The agent connects outbound over gRPC with mutual TLS — ECDSA P-256 certificates, 90-day rotation, auto-renewal 30 days before expiry. The agent generates its private key locally; the private key never leaves your cluster.
Every BYOC reference architecture — Redpanda, Confluent, ArgoCD, Okteto — uses mTLS.
Block us out anytime. Your workloads keep running.
Block the agent's egress to the control plane and all communication stops. Your applications continue running normally — standard Kubernetes Deployments, StatefulSets, and Services. Nothing proprietary to unwind. You lose management automation, not service availability.
Contractually guaranteed in the Axon Cloud Platform Agreement.
Not marketing. A legal commitment.
The Axon Cloud Platform Agreement includes a binding no-access warranty. When we begin SOC 2 audit work, scope will be narrow — control plane only — because we architecturally cannot access your data plane. The DPA covers only operational telemetry, not customer data, because there is no customer data to cover.
Binding no-access warranty lives in the Axon Cloud Platform Agreement. Shared Responsibility Model available on request as part of our security package.
Two more architectural boundaries determine whether Ultrathink ever sees your AI workload data, and whether an agent can ever exceed the user calling it. Both answers: no — by design, and enforced by code.
Ultrathink is not in the inference path.
When an agent running inside Axon calls a large language model — Claude, GPT, Gemini, or any other — the call goes from the agent in your cloud directly to the LLM provider, using your enterprise account with that provider, under the data retention terms you've negotiated with them.
Your LLM provider appears on your sub-processor list because they actually process your data. Under the platform agreement, Ultrathink does not.
An agent can never do more than the user calling it could do themselves.
MCP servers expose enterprise systems — your data warehouse, your CRM, your business apps — as governed tool surfaces for AI agents. Authorization is layered where it belongs: coarse tool access at the IdP, fine-grained data access at the system of record.
Tool call data, query text, and returned data do not transit the control plane. Authorization is never replicated outside the system of record that already owns it.
Who is responsible for what — clearly defined and contractually binding. This model is an exhibit to the Axon Cloud Platform Agreement.
| Control | Owner |
|---|---|
| Control plane hosting, patching, and availability | Ultrathink |
| Control plane network isolation | Ultrathink |
| Customer VPC / cloud account configuration | Customer |
| Customer cluster provisioning and patching | Customer |
| Customer network policies and firewall rules | Customer |
| Agent network egress policy (can block at any time) | Customer |
| Control | Owner |
|---|---|
| Control plane admin authentication | Ultrathink |
| Deployment token lifecycle (issuance, rotation, revocation) | Shared |
| Agent mTLS certificate enrollment and renewal | Shared |
| Customer team access to their cluster (IAM, RBAC) | Customer |
| Ultrathink personnel access to customer infrastructure | No Access |
| Control | Owner |
|---|---|
| Control plane data (deployment metadata, telemetry) | Ultrathink |
| Customer application data (databases, object stores) | Customer |
| Customer secrets and API keys | Customer |
| Encryption at rest — control plane databases | Ultrathink |
| Encryption at rest — customer cluster (etcd, PVCs) | Customer |
| Data residency — customer application data | Customer |
| Control | Owner |
|---|---|
| Container image builds (reproducible, from source) | Ultrathink |
| Container image CVE scanning before release | Ultrathink |
| Software Bill of Materials (SBOM) per release | Ultrathink |
| Container image signing (cryptographic attestation) | Ultrathink |
| Customer application dependencies | Customer |
| Control | Owner |
|---|---|
| Control plane operational secrets | Ultrathink |
| Customer-provided secrets (API keys, OAuth tokens) | Customer |
| Platform-generated credentials (per-app DB passwords) | Shared |
| Credential rotation — customer secrets | Customer |
| Control | Owner |
|---|---|
| Control plane health monitoring | Ultrathink |
| Agent health reporting (heartbeats, inventory) | Shared |
| Customer application monitoring | Customer |
| Security incident response — control plane | Ultrathink |
| Security incident response — customer environment | Customer |
| Control | Owner |
|---|---|
| SOC 2 certification (control plane scope) | Ultrathink |
| Customer's compliance obligations (SOC 2, HIPAA, etc.) | Customer |
| Penetration testing — control plane | Ultrathink |
| Audit logging — control plane API and gRPC | Ultrathink |
| Data Processing Agreement (GDPR) | Shared |
Every artifact we deliver to your cluster is built from source, scanned, signed, and auditable.
Container images built from source using Nix — deterministic, auditable, reproducible.
Trivy scans every container image before release. No critical or high CVEs ship.
Software Bill of Materials generated for every release. Know exactly what runs in your cluster.
Cryptographic image signing with cosign. Verify authenticity before deployment.
Non-root UID, read-only filesystems, dropped capabilities, seccomp profiles on every container.
Every chart passes linting, schema validation, and security scanning before release.
These restrictions are architecturally enforced — not just policy commitments.
Engineering hygiene is in place today. Formal certifications are on the roadmap, not in hand. Because of the BYOC architecture, most compliance obligations for your data remain yours — by design — which keeps our control plane audit scope narrow when we pursue certification.
CVE scanning blocking on CRITICAL (Trivy), CycloneDX SBOMs per release, cosign keyless image signing, Kyverno admission-policy enforcement, reproducible Nix builds, and dependency auditing (pip-audit, npm audit, govulncheck) on every build.
Customer-facing IR plan covers severity classification, response SLAs, breach notification workflow, patch publication SLAs, and nine incident playbooks. Aligned with SOC 2 CC7.3–CC7.5 and NIST SP 800-61. Available on request as part of our security package.
Data Processing Agreement covers the limited telemetry processed by the control plane. Narrow scope — we process operational metadata, not personal data, because customer data never leaves your cloud.
Neither Type I nor Type II is held today. Tier 0 critical control hardening is complete. Auditor engagement will be sequenced with customer and commercial requirements rather than a fixed internal calendar. When the audit begins, scope will use the carve-out method — customer infrastructure is explicitly excluded.
No third-party penetration test has been completed to date. Sequenced with SOC 2 engagement or ahead of customer deployments that require one. For deployments where a pen test is a prerequisite, we discuss contract commitments in the commercial conversation.
Self-assessment (CAIQ) in progress for the CSA STAR Registry. We will publish when complete.
No. There is no mechanism for Ultrathink personnel to access your cluster. The Axon Agent communicates outbound only — there are no inbound ports, tunnels, or reverse proxies. This is enforced at the network level, not by an access control list we manage.
In your cloud, in your region, under your control. The Ultrathink control plane stores only operational metadata (deployment topology, capability health, resource metrics). It never stores your application data, secrets, or credentials.
Your applications continue running. The agent cannot receive new configuration updates during an outage, but existing workloads — Deployments, StatefulSets, Services — are unaffected. The agent retries connection automatically when the control plane recovers.
No. Secrets are stored as Kubernetes Secrets in your cluster, encrypted at rest by your cluster's encryption configuration. The control plane stores only the names of secrets (e.g., "this app needs a secret called openai-api-key"), never their values.
None today — and we are transparent about this because enterprise security teams deserve the real answer. SOC 2 Type I and Type II: neither is held today. Tier 0 critical control hardening is complete and audit readiness work is in progress; auditor engagement will be sequenced with customer and commercial requirements. No third-party penetration test has been completed to date. Supply chain controls (CVE scanning, SBOMs, signed images) are in place today. For deployments that require specific assurance, we discuss contract commitments in the commercial conversation. Contact us for current status and to talk through your requirements.
Under the Axon platform agreement, no. Your agents call your LLM provider directly from your environment, using your enterprise account with that provider, and Ultrathink is not in the inference path. Your LLM provider — Anthropic, OpenAI, Google, AWS Bedrock, or any other — appears on your sub-processor list because they actually process your data. Under the platform agreement, Ultrathink does not.
No — and the architecture enforces it at two distinct points. First, the IdP issues access tokens audience-bound to the specific MCP server per RFC 8707 Resource Indicators, carrying IdP-granted scopes the gateway verifies on every call, so the agent can only reach tools it has been granted scopes for. Second, when the MCP server calls the backing system of record (Snowflake, Dynamics 365, Tableau, Google Workspace), it uses RFC 8693 OAuth 2.0 Token Exchange to swap the user's JWT for a downstream-platform access token that carries the user's own identity — CURRENT_USER() in the warehouse resolves to the actual human, and the backing system's native row-level security, masking policies, and role grants apply exactly as they would for that user logging in directly. The MCP server cannot widen what the user already has. We do not replicate your data's permission model in our layer — the system that owns the data keeps owning the decision. See MCP Authentication in Production for the full implementation and independent security context from Doyensec's 2026 MCP research and the OWASP MCP Top 10.
Yes. Our Data Processing Agreement covers the limited telemetry data processed by the control plane. Because customer data stays in your cloud, the DPA scope is narrow — we process operational metadata, not personal data.
Access for managed services (operational support, monitoring, incident response) is governed by a separate Managed Services Agreement with its own access controls, audit logging, and DPA. It is never granted under the platform agreement alone. The Outcome Partnership separates platform, professional services, and managed operations into three independent contracts.
Ultrathink operates three independent contracts: (1) Axon Cloud Platform Agreement — software license with a narrow DPA scoped to control plane telemetry, (2) Professional Services Agreement — build engagements with clear IP ownership, and (3) Managed Services Agreement — ongoing operations with SLAs and success-based fees. Each contract has its own liability cap, DPA scope, and can be signed independently. Learn more about The Outcome Partnership.
Request our full security package: Shared Responsibility Model, Incident Response Plan, current compliance posture, and Data Processing Agreement. We'll also walk you through a live Axon deployment so your security team can see the trust boundary in action.