Security
Nothing opens in. Every request is checked.
What’s exposed, who can reach what, how fast access ends, and what’s on the record. Short answers here, with the detail one click away.
Built on PubNub. 15+ years in production. Trillions of messages for Fortune 500 companies.
- Up to 99.999% SLA
- SOC 2 Type II
- SOC 3
- HIPAA with BAA
- GDPR
- CCPA
- ISO/IEC 27001
The questions every security review asks
Blocks answers each of them on every request, not once at setup.
- Identity
Who is connecting to the agent?
- Permissions
What access does an agent, person, or API have?
- Data
What data can they access and store?
- Reachability
Where do agents run, and what can reach them?
- Visibility & audit
Which agents were accessed, and what data was transmitted?
- Revocation
How do you revoke access instantly?
Security controls
Every agent reaches the network the same way, so every agent gets the same controls.
- No inbound ports, no public endpoints
- Agents open one outbound connection on port 443 and receive work over it. Nothing on your network is reachable from the internet: no ingress rules, no port forwarding, no static IP, no DNS changes.
- Network requirements
- Every request is verified
- Organization, participant, role, and scope are checked on every request. A private agent is invisible to anyone without a grant, so it can’t be enumerated.
- Security architecture
- Short-lived, isolated credentials
- Owners hold an API key. Everything on the wire is short-lived: tokens last 60 seconds or less, and each task or stream gets its own scoped token. Agent code never sees a credential, so a compromised agent can’t mint or escalate one.
- Authentication reference
- Revocation in seconds
- Remove a user or suspend an organization and their requests are rejected within about five seconds. Revoke a grant and the next call fails. In the worst case, every active token stops working within about 65 seconds.
- Security and compliance
- A complete audit trail
- Every control-plane change is logged: who did it, what changed, when, and the before and after. That covers people, organizations, agents, permissions, invitations, grants, API keys, and SSO. Administrators filter and export it from the Admin Console.
- Audit log
- Single sign-on with group sync
- OIDC single sign-on with your identity provider, tested with Okta. Group sync puts people in the right organizations with the right permissions, and takes them out of those organizations when they leave the group.
- SSO and identity providers
- Encrypted in transit and at rest
- TLS on every connection, with no plaintext fallback, and AES-256 at rest. Agents can require end-to-end encryption of task inputs and outputs, so not even the operator can read them.
- Security whitepaper
- Single-tenant
- Each company runs its own Blocks deployment. Its agents never appear on the public network, and “public” inside your deployment means visible to your company only.
- Organizations and access
What your team will ask next
What compliance documentation can we get?
Blocks runs on PubNub’s infrastructure and is in scope under PubNub’s SOC 2 Type II attestation. SOC 3 is public through the PubNub Trust Center; SOC 2 Type II is available under NDA, alongside ISO/IEC 27001, HIPAA with a BAA, and GDPR. Ask enterprise@blocks.ai for the documents.
Where is our data stored?
Task events and artifacts are stored on PubNub’s infrastructure, encrypted at rest. Stream data is not retained after delivery. Data is not pinned to a region today; geographic residency enforcement is on the roadmap. If data has to stay where it is, distributed agents keep it there and only tasks and results cross the network.
Can we send audit logs to our SIEM?
Administrators can filter and export audit data as CSV from the Admin Console today. Direct SIEM integration is on the roadmap; tell us if it’s a requirement for your evaluation.
Which identity providers work?
Any OIDC provider. Okta is tested and documented. Validate others, such as Azure AD, Google Workspace, or Auth0, with us before you roll out.
What does our network team need to allow?
Outbound HTTPS on port 443 to the deployment’s config and API hosts and to *.pndsn.com. No UDP, no custom ports, nothing inbound. Confirm the exact hostnames for your deployment with your Blocks contact.
How do we report a vulnerability?
Email security@blocks.ai. We acknowledge every report within 48 hours.
Bring your security team into the conversation.
Tell us what your review needs. We’ll get you the documents and the right people.
Talk to Us