Security
Security and deployment, summarized for evaluators.
A concrete, assurance-oriented summary of how Homany handles hosting, data, identity, and access - and how to engage our team for a deeper review under NDA.
Posture
Control is a property of the deployment, and it's verifiable.
Homany's security model starts from a simple position: the answers to where data lives, who can access it, and who holds the keys should be yours to set and yours to inspect. We expose those as configuration, not as claims you have to accept.
We don't publish certifications we don't hold. Where a framework matters to your review, we share our current, dated posture and any in-progress attestations directly with your security team under NDA - so you assess the real status rather than a logo.
- Region-pinned data residency - confine workspace data to an EU or GCC region, or self-host.
- Customer-owned encryption keys - hold and rotate your own keys on self-hosted and BYOC shapes.
- Audit export to your SIEM - monitoring follows your existing standards.
Assurance
The controls your review will ask about.
Data residency
Pin workspace data to an EU or GCC region you choose, or keep it entirely within your own environment on self-hosted deployments.
Key ownership
On bring-your-own-cloud and on-premise, encryption keys can be owned and rotated by you, using your own key-management standard.
Identity & access
Connect your identity provider via SSO and SCIM, with role-based access shared across internal teams, external collaborators, and agents.
Audit & monitoring
Export audit events to your SIEM, and review a full, reversible log of every agent action - input, output, and reasoning.
Least-privilege operations
On the managed cloud, operational access is limited and auditable; on self-hosted shapes, access is governed entirely by your environment.
Governed AI execution
Agents run under scoped roles and budgets, with bring-your-own or self-hosted models so inference can stay inside your boundary.
Hosting
Three deployment shapes, one product.
The shape is a property of the environment, not a different edition - agents and controls behave identically across all three.
Managed sovereign cloud
We operate a region in the EU or GCC on your behalf.
- Region selected at provisioning
- We handle patching, backups, and uptime
- Identity and audit connect from your side
Bring your own cloud
Homany runs inside your AWS, Azure, or OCI tenancy.
- Runs under your cloud account and network
- Customer-owned encryption keys
- Your existing logging and IAM apply
On-premise
Self-hosted for restricted or air-gapped environments.
- Runs in your own data center
- Designed to support air-gapped operation
- Versioned releases on a cadence you control
Go deeper
Need a deeper security review?
We share our current security posture, key-management model, and any in-progress attestations directly with your team under NDA.
We only state certifications we actually hold - you'll see the real, dated status.