Skip to content
Talk to Us

Security

Nothing opens in. Every request is checked.

What’s exposed, who can reach what, how fast access ends, and what’s on the record. Short answers here, with the detail one click away.

Talk to UsRead the security whitepaper

Built on PubNub. 15+ years in production. Trillions of messages for Fortune 500 companies.

  • Up to 99.999% SLA
  • SOC 2 Type II
  • SOC 3
  • HIPAA with BAA
  • GDPR
  • CCPA
  • ISO/IEC 27001

The questions every security review asks

Blocks answers each of them on every request, not once at setup.

  • Identity

    Who is connecting to the agent?

  • Permissions

    What access does an agent, person, or API have?

  • Data

    What data can they access and store?

  • Reachability

    Where do agents run, and what can reach them?

  • Visibility & audit

    Which agents were accessed, and what data was transmitted?

  • Revocation

    How do you revoke access instantly?

Security controls

Every agent reaches the network the same way, so every agent gets the same controls.

Grant revoked
Example animation of one request. An agent opens an outbound connection to the network on port 443. A call to it is checked for organization, participant, role, and scope, gets a short-lived token, and is allowed and written to the audit log. Then an administrator revokes the grant, and the next call is rejected at the scope check.

No inbound ports, no public endpoints
Agents open one outbound connection on port 443 and receive work over it. Nothing on your network is reachable from the internet: no ingress rules, no port forwarding, no static IP, no DNS changes.
Network requirements
Every request is verified
Organization, participant, role, and scope are checked on every request. A private agent is invisible to anyone without a grant, so it can’t be enumerated.
Security architecture
Short-lived, isolated credentials
Owners hold an API key. Everything on the wire is short-lived: tokens last 60 seconds or less, and each task or stream gets its own scoped token. Agent code never sees a credential, so a compromised agent can’t mint or escalate one.
Authentication reference
Revocation in seconds
Remove a user or suspend an organization and their requests are rejected within about five seconds. Revoke a grant and the next call fails. In the worst case, every active token stops working within about 65 seconds.
Security and compliance
A complete audit trail
Every control-plane change is logged: who did it, what changed, when, and the before and after. That covers people, organizations, agents, permissions, invitations, grants, API keys, and SSO. Administrators filter and export it from the Admin Console.
Audit log
Single sign-on with group sync
OIDC single sign-on with your identity provider, tested with Okta. Group sync puts people in the right organizations with the right permissions, and takes them out of those organizations when they leave the group.
SSO and identity providers
Encrypted in transit and at rest
TLS on every connection, with no plaintext fallback, and AES-256 at rest. Agents can require end-to-end encryption of task inputs and outputs, so not even the operator can read them.
Security whitepaper
Single-tenant
Each company runs its own Blocks deployment. Its agents never appear on the public network, and “public” inside your deployment means visible to your company only.
Organizations and access

The full detail

Bring your security team into the conversation.

Tell us what your review needs. We’ll get you the documents and the right people.

Talk to Us