Credentials at rest
Customer-authorized credentials live in Infisical. Human credentials and recovery material live in 1Password, not in code or agent definitions.
OperationalMarshal security posture
Security for managed AI operations.
Marshal designs, deploys, and operates agents with authority kept narrow, credentials kept out of agents, and customers kept in control of approvals and rules.
Control Plane owns trustData Plane borrows authorityAgents never own credentials
Founder-led teams use Marshal
Security controls
Practical safeguards for the systems, people, and agent authority behind Marshal's Managed Agent Operations service. Select any category to see the underlying controls.
OperationalDocumented commitmentIn progress
Data protection
Trust is enforced through identity, credential, runtime, and recovery boundaries. Current gaps stay visible until they are closed and tested.
Transport protection
Encrypted transport is required for application and administrative traffic across Marshal's managed cloud providers.
Documented commitmentScoped agent runtime
Credentials are resolved for authorized work. Agents do not receive general vault access or become the durable credential owner.
Documented commitmentBackup and recovery
Automated database backups, secrets recovery testing, and annual recovery exercises remain open work items.
In progressPolicies and Practices
Security Practices
We take the security of your data very seriously at Marshal. If you have additional questions regarding security, we are happy to answer them. Please write to security@runmarshal.com and we will respond as quickly as we can.
Internal policies drafted
Access control, credential management, incident response, and business continuity.
CAIQ readiness baseline complete
Internal working assessment. Not submitted to CSA STAR.
Independent security assessment planned
No penetration-test or third-party audit claim is made today.
Policies and diligence material
Security library.
Detailed policies and diligence materials can be shared with qualified customers upon request.
Public
Security overview
This page
Credential-handling principles
Control Plane, Data Plane, and agent boundaries
Infrastructure and provider summary
Core providers and operating roles
Responsible disclosure
security@runmarshal.com
Available after review
Access Control Policy
Prepared for approval
Secrets and Credential Management Policy
Prepared for approval
Incident Response Policy
Prepared for approval
Business Continuity and Disaster Recovery Plan
Prepared for approval. Recovery objectives are not yet validated.
CAIQ v4.1 readiness baseline
Internal draft. Not publication-ready.
Vulnerability assessment
Not yet available
Core service providers
Marshal uses established managed platforms for hosting, data, delivery, source control, credential management, and frontier-model access.
VercelSupabaseCloudflareGitHubInfisical1PasswordOpenAIAnthropicComposio
Composio is not currently deployed. A formal subprocessor and data-location summary will be published after deployment regions are verified.
Responsible disclosure
If you believe you have found a vulnerability affecting Marshal, please report it directly. We will acknowledge the report, investigate it, and keep you informed as we work toward resolution.
Report a vulnerability