Security
OneWorld AI sits between your team and the models they use. Your code passes through our infrastructure, and our access rules decide who can reach it.
The gateway
Your prompts and the code an agent reads go through OneWorld AI's own inference gateway, never from a laptop straight to a model API.
The gateway inspects every request for prompt injection and flags attempts before they reach the model. It also inspects every request for sensitive data, and when that detector fires the request is routed to a self-hosted model, either automatically or after you confirm.
Plugins are scanned before use, and the report covers what a plugin does, including behavior you wouldn't see from its listing.
Where it runs
Components run either in OneWorld AI's managed cloud or in your own cloud or IDC.
| Component | OneWorld AI cloud | Your cloud or IDC |
|---|---|---|
| Database | Firebase and BigQuery | Supabase and ClickHouse |
| Agent | Claude Code or Codex | The OneWorld AI Agent |
| Agent sandbox | E2B | E2B |
| Model | AWS Bedrock | An open-source model |
What we log
Sensitive operations, LLM calls, sandbox starts, and data-analysis tasks all go to an audit trail.
Operational telemetry keeps identifiers, timings, event types, and error codes. Your prompts, code, and message bodies never enter that pipeline, and secrets are scrubbed from logs.
Verifying the app you run
You can check that the app on a machine is the app we built.
Enterprise builds ship on their own release channel with pinned versions, so you stay on the build you accepted.
Builds are reproducible, meaning the same source tree produces the same artifact digest. Checkouts and dependencies are pinned to commit SHAs and content digests, release artifacts are signed and verified at install and at launch, and signing keys are rotated. Commit signing is required on protected branches and checked in CI.
Who can open your work
Most operations follow a company role, but core records, including thinking traces, use relationship-based access, or ReBAC, which means what you can open depends on your relationship to that record and not on your job title alone.
A session opens for the person who created it and for the colleagues they granted editor or viewer access with Share.
How people sign in
Sign-in is enterprise SSO through WorkOS on every client surface, and MFA is available for account login and for sensitive operations.
Session and token lifetime is configurable per client policy, anywhere from 10 minutes to 7 days. When someone's role or membership changes, de-provisioning takes effect within 10 minutes.
The desktop app signs in with a device code, which keeps the secret out of a window that could be hijacked.
Data through its life
What goes into a model, what comes back, analysis results, and erasure all sit under the same relationship-based access as the session itself.
A session that ran only on a computer stays on that machine until someone uses Share, which copies a mirror into OneWorld AI.
Deleting a session can't be undone. It asks you to confirm, releases the runtime, and removes that session's data. You can also set a retention period, and a session that reaches it is deleted for you.
Releasing or archiving a session tears down its compute and keeps the history until deletion.
GitHub
Integrations covers connecting GitHub and what an agent can do once it is connected.
The token is stored encrypted, using the organization admin's permission, a salt, and a KMS secret. OneWorld AI checks the GitHub App's grants before every call.