Trust Center
Security you can verify, governance you can prove.
Tokoaido deploys AI agents that act on real systems, so security, privacy and governance are the substrate, not an add-on. Here is exactly how we protect your data and keep autonomy accountable.
Security architecture
Defense in depth, from identity to the audit log.
- OIDC single sign-on (Okta, Entra ID, Auth0, Google)
- Built-in TOTP MFA, or MFA through your identity provider
- RBAC: Owner / Admin / Operator / Viewer, plus custom roles
- Agents cannot call write tools directly; every write is proposed and governed
- TLS in transit, with HSTS
- Connector credentials and MFA secrets encrypted with AES-256-GCM under a rotatable keyring
- Disk encryption at rest depends on the host
- Tenant isolation enforced on every route and in the data layer
- Session tokens in HttpOnly cookies
- One audit log for every consequential action: actor, target, risk, reason
- Every approval requires a written reason
- Hash-chained lineage for energy setpoint decisions
- Audit log viewable in the product; export on request
- Human-in-the-loop, risk-tiered approvals
- Earned, progressive agent autonomy
- Golden-scenario checks and regression gates
- Guardrail synthesis from violations
- Your systems remain the system of record; we keep a working copy of what a use case reads
- Hosted in the EU (Helsinki); AI inference by MiniMax in Singapore. Self-host to keep everything in your region
- Configurable retention
- Data-subject request support
- Our EU-hosted service, or self-host
- Docker or Kubernetes, on-prem or in your own cloud account
- Fully offline runs without the LLM features
- Outbound-only from the plant when the edge publishes to the broker
The safety boundary
A line agents cannot cross, by construction.
For operational technology, safety is not a policy toggle. Writes route through MES/SCADA with human approval; a direct PLC write, or any interaction with a Safety Instrumented System, is blocked in the architecture itself. No prompt, configuration, or model can override it.
Compliance
Controls mapped to the frameworks your auditors use.
We do not hold any certification today. Tokoaido is at design-partner stage, and each control we call implemented names the automated test that proves it. We share that mapping under NDA.
Deployment
Deploy where your data must live.
Sub-processors
Who touches your data.
Named rather than categorised, because a privacy review needs the names. The full list adds what personal data each can receive, which are optional, and where a signed DPA is still outstanding. You get 30 days' notice before we add or replace one.
Documents & requests
Get what your review needs.
Operations X-Ray
Bring us your security review.
We'll walk your team through the architecture, controls, and deployment model, and answer the hard questions.