Trust
Built to be trusted with the keys.
Centeye sits on your accounts, mailboxes and devices, and acts on them. Here is how the platform is built and run, how it acts safely on your behalf, and how your data is handled.
The platform
Secure and multi-tenant by design.
Built multi-tenant from day one
Each customer’s and each client’s data is kept separate throughout the platform, with tenant isolation enforced in the data layer, not just in the interface.
Encrypted in transit and at rest
Data moving to, from and within Centeye is encrypted in transit, and stored data is encrypted at rest.
Least-privilege access
Each connection to Microsoft, Google or a device is granted only the access it needs to detect and respond.
Controlled access for our own team
Access to production systems is limited to the people who need it, protected with strong authentication, and logged.
Secure development
Changes are reviewed and tested before release, and dependencies are tracked and kept up to date.
Monitored around the clock
The platform is monitored continuously for availability and security events, with an incident process to match.
Acting safely
Power to act, with guard rails.
You set how far it goes
Every action runs on your dial, per client and per action: tell me, ask me first, or handle it. Risky steps never run on their own.
Checked, and undone where possible
Every action is checked at the provider afterwards and can be undone wherever the provider allows. Protected accounts and devices can be put beyond reach.
A record of every step
Who, what, why and when, for every action, kept in a tamper-evident record.
AI agents bounded like staff
Centeye’s own AI agents act only through governed tools, inside your rules, and every step they take is recorded.
Your data
Only what a decision needs.
We take only what a decision needs
Centeye collects the signals needed to detect and respond, and avoids collecting content it doesn’t need.
Email content isn’t kept
Mail is analysed for threats and message bodies are not retained after a verdict. We keep the signal, not your mail.
What the AI sensors never read
The Lumen browser extension and device sensor see which AI service, which person and how much data. They never read files, messages or the words typed.
Your data serves your security
Customer data is used to deliver detection, response and reporting. It is never sold.
A Data Processing Addendum is available for customer and partner agreements. See the DPA and our privacy policy.
Sub-processors
Who helps us deliver the service.
We use a small number of established providers for hosting, email delivery and similar services. The current list is available on request, and customers can ask to be told about changes.
Questions
Have a security or trust question?
We’re happy to walk through how Centeye is built and run. Write to security@centeye.io.