Monroe

Trust Center

The trust center for the team
handing Monroe the keys.

The failure modes most AI agents quietly accept (silent overspend, ambient data access, autonomous external sends) are designed out from day one. Here is the architecture, in one place your security team can read.

Last reviewed July 13, 2026

  • Inference stays inside AWS
  • Never trained on your data
  • Every run logged with verified usage
  • DPA and security questionnaires handled
  • US data residency, EU on the roadmap

Per workspace

process isolation

OAuth-first

credential model

Spend cap

checked every run

Approval gates

on email + calendar sends

SSO + SCIM

on Enterprise

SOC 2

Type I in progress

Identity

Sign in with the identity provider you already run.

Enterprise workspaces add SAML 2.0 and OIDC single sign-on with Okta, Azure AD, Google Workspace, and JumpCloud, plus SCIM provisioning so accounts are created and deactivated by your directory, not by hand. Access stays where your IT team governs it.

SSO and SCIM are included on Enterprise.

Architecture

Six controls, designed in from day one.

Not policies bolted on after the fact: the isolation, credential, spend, and approval model is how Monroe is built. Each control below is the architecture, stated plainly.

Tenancy

One Monroe per workspace. Always.

Every customer gets a dedicated Monroe instance, isolated, with its own state, skills, memory, and credentials. Agent compute, state, and context are isolated per workspace, never shared with another customer’s Monroe.

  • Dedicated agent runtime per workspace: compute is never shared
  • Per-workspace encrypted volume, with access scoped to that workspace alone
  • Broker-only ingress: nothing but Monroe’s own broker can reach an agent
  • Database rows tenant-scoped with row-level security, so cross-tenant reads are structurally blocked

Credentials

OAuth-first. Monroe never sees a password.

Every tool that supports OAuth connects with scoped permissions: you pick what Monroe can see (a folder, a repo, a channel, not the whole account). Data providers that only issue developer keys take your own revocable key, pasted into the dashboard vault, never into chat. Revoke either kind from your dashboard or the upstream tool, and Monroe loses access on the next request.

  • OAuth-first connector model: passwords never enter the system
  • Per-connector scope: folder-level Drive, folder-level Box, channel-level Slack
  • Per-workspace scoped credentials give the agent’s model and cloud access, never shared across customers
  • Customer can revoke any connector instantly; Monroe loses access on next call

Credits

A cap Monroe checks before every run.

Every workspace has a monthly spend cap. Your usage is checked before each run dispatches, and at the cap Monroe pauses the workspace: no surprise invoices, no silent overuse. Usage is metered in credits per workspace and counted against your cap.

  • Cap checked before every run: at the cap, the workspace pauses and Monroe says so in your channel
  • Usage is re-verified against the cap continuously as a backstop
  • Dashboard shows live credit usage, daily breakdown, and a forecast that flags when you are on track to exceed your bundle
  • A hard per-run iteration bound stops a runaway agent loop mid-run

Approvals

Anything that leaves the building needs a human.

Monroe drafts. You approve. Email sends and calendar invites are blocked by the runtime until someone approves in Slack or Teams, in every mode. Other external writes (CRM changes, file and doc writes) are draft-first by Monroe’s operating rules: presented in-channel before it acts. Read-only research never needs an approval.

  • Send an email? Blocked until you approve, enforced by the runtime.
  • Create a calendar invite? Blocked until you approve, enforced by the runtime.
  • Modify a CRM record or write to a file store? Draft-first: Monroe presents it in-channel and asks before acting.
  • Dangerous system commands? Blocked outright, in every mode.
  • Read a Slack thread, summarize it, post in-thread? No approval needed, it’s read-only.

Audit

Every run leaves a record.

Every Monroe run is logged to your workspace: who asked, in which channel, at what time, visible to workspace admins in the dashboard next to live credit usage and a verified usage breakdown. Enterprise customers can request a CSV export.

  • Run history in the dashboard: who triggered each run, where, and when
  • Live credit meter + daily usage breakdown + overage forecast
  • Verified usage, reconciled at the source
  • One-off CSV export on request for Enterprise: enterprise@getmonroe.com

Compliance

SOC 2 Type I in progress. Pen test booked.

We’re building Monroe with SOC 2 controls baked in from v0, not retrofitted. The audit timeline, the booked penetration test, and the procurement documents your legal team will ask for are all below.

  • SOC 2 Type I: in progress with Vanta, Q3 2026 target
  • SOC 2 Type II: audit follows, Q1 2027 target
  • SSO (SAML 2.0 / OIDC) and SCIM provisioning: included on Enterprise
  • Independent penetration test: scheduled for production launch
  • DPA, BAA, SCC available on request: legal@getmonroe.com
  • Data residency: US-East today; EU on the Enterprise roadmap; AP-Southeast on the 2027 roadmap

The vendors that touch your data,
and what they each do.

We list every sub-processor in the data path here, with what they handle and where they run. We notify Enterprise customers 30 days before adding a new one.

VendorPurposeRegion
AWSCloud hosting, compute, storage, and model inference; prompts never leave our AWS accountUS-East (EU on the Enterprise roadmap)
ClerkIdentity + SSO + session managementUS
StripeBilling, payment processing, Stripe TaxUS/EU
VercelMarketing site hosting + edge CDNGlobal
PostHogProduct analytics on the site and dashboardUS
VantaSOC 2 evidence collectionUS

This is the canonical list, kept current at getmonroe.com/security. Last reviewed July 13, 2026.

Documents

The paperwork, ready before you ask.

Everything a diligence pass asks for, in one place. Anything not linked below comes back same-day from a real person.

Security overview, as a PDF

This page, print-formatted to a single sheet for your vendor file. Generated from the live page, so it is always current.

Data Processing Agreement

Never-train commitment, breach notification, and sub-processor terms.

Read the DPA

Security commitments

The formal, legal-format version of this page.

Read the policy

Privacy policy

What we collect on the site and in the product, and why.

Read the policy

Sub-processor list

Published on this page. Enterprise customers get 30 days’ notice before we add one.

View the list

Data residency

Where workspace data lives today and what is on the roadmap.

Read the doc

Approval model

Machine-enforced gates, draft-first writes, and hard floors, in detail.

Read the doc

Audit log and run receipts

What gets logged per run and how workspace admins review it.

Read the doc

BAA and SCC on request: legal@getmonroe.com. Enterprise customers get fully signed copies; pilot customers get the latest under-review draft.

The questions your security team will ask.
Answered directly.

Do you train on my data?

No. Workspace data is never used to train AI models, ours or anyone else’s. Your messages, your documents, your CRM records stay your data. Contractually committed in the DPA.

Where is my data stored?

US-East AWS today; EU residency is on the Enterprise roadmap; email enterprise@getmonroe.com if it gates your purchase and we will sequence it. Your data is isolated per workspace, kept separate from every other customer. The full sub-processor list is published at getmonroe.com/security and we email customers 30 days before adding one.

How do credentials work?

OAuth where the tool supports it; for data providers that issue developer keys you paste your own revocable API key in the dashboard, never in chat. Monroe never sees your password, never holds an API key in a model’s context window, and never asks you to paste a secret into chat. Tokens and keys live in an encrypted secrets vault scoped to a single workspace, revocable from one button in your dashboard.

What happens if I revoke access?

The connector goes dark. Monroe loses access on its next call to that tool, and an in-flight run that depends on it fails rather than continuing. Your run history stays in your dashboard, so you can audit what happened before revocation. Re-connecting at any time picks up where things left off.

What’s your SOC 2 status?

SOC 2 Type I is in progress with Vanta, Q3 2026 report target. Type II audit follows with a Q1 2027 target. Sub-processors are listed publicly so your security team can review them before any call. We don’t pretend to have certifications we’re still working toward.

How do you handle prompts that try to exfiltrate data?

Defense by architecture. Every workspace’s data access is default-deny: a confused agent cannot read another customer’s data. Each agent runs isolated with its own credentials. Email sends and calendar invites are blocked by the runtime until a human approves them in Slack or Teams, and dangerous system commands are blocked outright. A poisoned document can’t silently leak through an outbound email because a human is in that loop.

Can Monroe act without approval?

For reads, yes: searching Drive, querying HubSpot, summarizing a Slack thread. Emails and calendar invites are machine-enforced: the runtime blocks them until someone approves in Slack or Teams, in every mode. Other external writes (CRM, files, docs) are draft-first by Monroe’s operating rules: presented in-channel before it acts. The workspace approval mode (recommended / strict / manual) adds review on top, up to holding every flagged operation.

What’s your security incident response?

Page is monitored 24/7. Customer-impacting incidents trigger notification within 24 hours per the DPA, with a postmortem inside 14 days. Email security@getmonroe.com for disclosures: we acknowledge within 24h and coordinate on a 90-day default timeline.

Bring this to your security team.

Send your questionnaire (SIG, CAIQ, or your own), ask for an architecture review, or ask the question that decides it. A real person answers, fast.

Prefer email? security@getmonroe.com reaches the same people.

Security researchers: email security@getmonroe.com. We acknowledge within 24h and coordinate disclosure on a 90-day default timeline.

Monroe

Security overview · getmonroe.com/security · Last reviewed July 13, 2026

Monroe is the AI employee for commercial real estate. It works in Slack, Microsoft Teams, and email; the web dashboard is the control plane. This sheet summarizes the security architecture; the live version, the FAQ, and the formal policies are at getmonroe.com/security.

Controls

Sub-processors

VendorPurposeRegion
AWSCloud hosting, compute, storage, and model inference; prompts never leave our AWS accountUS-East (EU on the Enterprise roadmap)
ClerkIdentity + SSO + session managementUS
StripeBilling, payment processing, Stripe TaxUS/EU
VercelMarketing site hosting + edge CDNGlobal
PostHogProduct analytics on the site and dashboardUS
VantaSOC 2 evidence collectionUS

Security: security@getmonroe.com (24h acknowledgement, 90-day coordinated disclosure) · Legal, DPA, BAA, SCC: legal@getmonroe.com · Enterprise: enterprise@getmonroe.com