Technical Reference · Platform security
Platform security
The security posture, architecture, and data handling practices of the AI Control Plane.
Terminology
In this document, “Customer” refers to the user of the platform. “End User” refers to a user of an MCP server hosted by the platform on behalf of the Customer.
Trust center
For a security and compliance review, visit the Speakeasy Trust Center for audit reports, certifications, and compliance documentation.
The AI Control Plane is designed as a high-performance, security-first, agent governance platform. It connects to your agents, provides an MCP gateway, and enforces fine-grained permissions, threat detection, and full observability.
Certifications
Section titled “Certifications”The platform maintains the following security certifications and compliance standards:
- SOC 2 Type II - Independently audited controls for security, availability, and confidentiality
- ISO 27001 - International standard for information security management
- GDPR compliant - Data processing agreements available with privacy by design
- CCPA compliant - User data deletion on request
Industry affiliations
Section titled “Industry affiliations”Speakeasy is affiliated with The Linux Foundation, the Cloud Security Alliance, and the Agentic AI Foundation.
Architecture overview
Section titled “Architecture overview”The diagram below shows the full stack. Hover or click a flow in the legend to isolate it; use Expand for fullscreen.
The platform is hosted on Speakeasy-managed cloud infrastructure. It is tenanted, with data encrypted per customer, and consists of the following components.
Control plane
Section titled “Control plane”- API server - A Go service built with the Goa design-first framework. One API design generates the REST API, its OpenAPI spec, and the TypeScript SDK, and every service handler enforces RBAC.
- Dashboard - The web interface for managing the platform, built in React on the generated TypeScript SDK.
- CLI - A Go binary that talks to the same REST API as the dashboard.
Data plane
Section titled “Data plane”- MCP gateway - The ingress for agent traffic. Agents connect over HTTP and SSE with per-organization JWTs; the gateway resolves the toolset for each tool call and dispatches to OpenAPI tool connectors or sandboxed function runners.
- Guardian - Inline scanners on every request and response through the gateway: prompt-injection detection, PII and secret scanning, and an egress allow-list.
- Function runners - Sandboxed, per-tenant Kubernetes pods that execute custom MCP function code.
- Tool connectors - Turn sources into tools. Supported source types include OpenAPI 3.0 and 3.1 documents, TypeScript functions, third-party catalog servers, custom remote MCP servers, and tunneled MCP servers.
- Telemetry ingest - An OTLP endpoint receives logs and telemetry from instrumented agents. Events land in ClickHouse, power the Observe pages, and can follow project-scoped routes to external collectors through data exports.
Asynchronous processing
Section titled “Asynchronous processing”Deployments, cleanup, and usage jobs run as Temporal workflows. Deploying a source enqueues a workflow that builds and deploys the runner image to Kubernetes, fetching the bundle from encrypted object storage; a reaper workflow cleans up idle runners.
Data stores
Section titled “Data stores”- PostgreSQL - The primary metadata store, with schema managed through Atlas migrations
- Redis - Caching and rate limits
- ClickHouse - The audit and usage store; the gateway records every tool call here
- Object storage - Function bundles and assets, encrypted with KMS-managed keys
External dependencies
Section titled “External dependencies”- WorkOS - SSO (OIDC and SAML) and directory sync
- Remote MCP servers - Customer-supplied servers, reached only through the egress allow-list
- Customer SaaS APIs - Third-party APIs behind tool connectors, authenticated with OAuth or API keys
Authentication
Section titled “Authentication”Access is granted through Organizations with login support available through Google and GitHub identity providers. Unauthenticated sessions are not supported.
SSO support is available on request to enterprise customers.
Encryption
Section titled “Encryption”All data processed by the platform is encrypted in transit. HTTPS is the standard protocol for all MCP servers hosted by the platform.
For Customers using platform-managed authentication, Customer keys and secrets are encrypted using symmetric key encryption (AES-GCM) in the database, in addition to the encryption defaults provided by Google Cloud SQL. OAuth access and refresh tokens obtained through managed OAuth flows are encrypted before storage in the same way.
Customer-managed encryption keys
Section titled “Customer-managed encryption keys”For Customers who need control of the key material behind the platform’s cryptographic operations, the platform supports customer-managed encryption keys (BYOK). An organization administrator registers the organization’s own AWS KMS or Google Cloud KMS key for the platform to use. The platform authenticates to the Customer’s cloud account keylessly, using cross-account role assumption on AWS or Workload Identity Federation on GCP. No long-lived cloud credentials are ever stored, access is verified before a key is used, and the Customer can revoke access at any time.
Business continuity and disaster recovery
Section titled “Business continuity and disaster recovery”If the platform experiences downtime, there is no impact to the Customer’s API uptime. MCP servers hosted by the platform will become unavailable, meaning requests from MCP clients to those specific servers will not be processed.
Metadata on Customer toolsets is stored in Google Cloud SQL with:
- Multi-region replication
- Failover redundancy
- Encrypted connections
Data storage FAQ
Section titled “Data storage FAQ”Does the platform store API or customer data?
Section titled “Does the platform store API or customer data?”The platform does not store Customer data. It only processes data in transit.
Customers can opt in to storing agent session transcripts, tool call telemetry, and tool call inputs and outputs based on their needs. Each has its own toggle on the Logs page of the organization dashboard:
Can the platform store API secrets?
Section titled “Can the platform store API secrets?”By default, the platform does not store API secrets.
Customers have the option to store API secrets if they choose to use platform-managed authentication and API keys. Stored secrets live in Environments, which are secure, encrypted stores of key-value pairs scoped to the project. When an MCP server uses a managed OAuth flow, End User access and refresh tokens are encrypted before being stored so the platform can complete the flow on the End User’s behalf.
How long is log data retained?
Section titled “How long is log data retained?”By default, agent session transcripts, tool calls, and metadata are stored for 90 days. Which categories are stored at all is controlled by the Logs page toggles shown above; see Logging & Telemetry for the full reference.