// security & deployment
Your code stays where it is allowed to go.
Sage is built so that nothing reaches a model or one of your systems except through routes you control. Here is how it is deployed and governed.
// 05 · deployment & integrations
Runs where your code is allowed to go.
Your code, prompts and accumulated knowledge stay inside your boundary, with the model providers you choose — including self-hosted.
// option 1ManagedWe run it for you. Fastest to start a pilot.
// option 2Your cloudDeployed in your VPC — AWS, Azure or GCP [CONFIRM].
// option 3On-premisesFor strict data residency, with self-hosted models.
// connects to
LinearJiraGitHubGitLabBitbucketGitHub ActionsJenkinsAzure DevOpsSonarQubeSnyk
// models fromAnthropicOpenAIGoogleOpenRouterAWS BedrockSelf-hosted
// how sage is governed
Two routes out. Both under your rules.
- model railOne route to every modelAgents do not call model providers directly. Every call goes through Model Rail, which applies your model policy and attributes the cost.
- tool gatewayOne route to your systemsActions on repositories, tickets and CI go through Tool Gateway, which applies the rules and approval gates you set.
- approval gatesPeople approve what mattersWorkflows pause at the steps your policy marks for human approval, and continue only when someone signs off.
- tracingEvery run is tracedEach step records its inputs, prompt version, model, output and approver, so any change can be traced back.
// report a vulnerability
Found a security issue?
Please tell us privately before sharing it publicly. Emailsecurity@sdlcagents.ai with the details and how to reproduce it. Our contact details are also published insecurity.txt.
// security review
Going through a security review? Talk to us.
We’ll walk your security team through how Sage would run in your environment.
Scope a pilot