Security

Crawbl is built for organizations that need strong security controls over AI agent behavior.

Trust Model

Three trust levels govern what the system can do on a user's behalf.

Observe

Read-only. Crawbl reads and summarizes but cannot change external systems.

Ask before write

Before creating or updating anything, Crawbl shows a clear proposal. This is the default.

Trusted automation

Bounded actions can run automatically under explicit limits and policies.

Zero Trust Architecture

Principle	Implementation
Never trust, always verify	All requests authenticated, all services verify each other
Least privilege	Components get minimum permissions needed
Explicit verification	No implicit trust based on network location
Assume breach	Segmentation limits blast radius

Click diagram to zoom

Internal service communication is mutually authenticated and encrypted.

Secret Management

All secrets are stored externally -- never in Git.

Secret Type	Storage	Access
API Keys	Managed secrets service	Auto-synced to runtime
OAuth Tokens	Managed secrets service	Per-user, encrypted
Database Credentials	Managed secrets service	Injected via K8s secrets
TLS Certificates	Automated cert management	Auto-renewed

Click diagram to zoom

Secrets are automatically rotated where possible, scoped to specific workspaces, and audited for access.

Network Security

Agent runtimes have no direct internet access.

Click diagram to zoom

Internal service communication is mutually authenticated and encrypted. Network policies restrict traffic to authorized paths only.

This is enforced at the network level. Even a compromised agent pod cannot reach external services -- all outbound access goes through the orchestrator, which enforces permissions and logs every call.

Compliance

• Audit trail -- Every action logged with timestamp, user identity, action type, and result
• Data residency -- Deploys in your infrastructure; no data leaves your environment
• Certifications -- Designed to support SOC 2 Type II, HIPAA, GDPR, and ISO 27001

Deep Dive

• Authentication Flow - OAuth and auth implementation details