The confidence to recommend Aarmos internally.
One page, forwardable, that answers what a security reviewer asks: what Aarmos touches, what it doesn't, and what your team can verify without us. App-visible behavior only — never a certification claim.
Maintained by Aarmatix LLC, the maker of Aarmos. Last updated August 8, 2026. This page describes product behavior; it is not an audit, attestation, or independent verification.
What Aarmos assumes — and what it doesn't.
Aarmos assumes the operator's machine is trusted. It does not assume the network is trusted, the model provider is trusted, or that any tool the agent calls behaves as documented.
Aarmos does not claim to prevent every unsafe agent behavior. It claims that every action the agent takes passes an explicit policy decision, and that the decision is provable afterward.
Data boundary.
Aarmos is local-first. The policy gate runs on the operator's machine. Credentials, prompts, and tool inputs stay on that machine. Policy evaluation, receipt signing, and key custody never require our cloud.
What leaves the machine is only what the operator sends — the agent's own calls to whichever model or tool it was configured to reach. Aarmos does not phone home with agent content.
- Policy decisions and receipt signing run on-device.
- No agent prompts, tool inputs, or outputs sent to Aarmos.
- Workspace features (accounts, membership, entitlements, audit event envelopes) use our backend; payloads never do.
- Evidence forwarding to your SIEM is opt-in, admin-configured, and envelope-only.
- Local observation binds to loopback only; a browser joins with a single-use pairing code exchanged for a short-lived, read-only session.
Full data-flow detail lives in the privacy notes.
Independent verification.
Every decision produces a signed Receipt. Receipts verify with a portable Apache-2.0 artifact that runs without Aarmos. Your team can audit, replay, or archive them years after the runtime is gone.
$ avar verify receipt.json
ok · chain intact · policy pinned · signature valid
- Receipts are signed and tamper-evident.
- Verifier is portable and runs without network access.
- Receipt format is published under CC BY 4.0; verifier code is Apache-2.0.
- No dependency on Aarmos uptime or goodwill.
Shared responsibility.
- Aarmos
- Policy decisions, Receipts, portable verifier, workspace governance features.
- App owner
- Policies, allow-lists, who gets access, incident process.
- Operator
- Machine trust, credentials, model and tool keys.
What we don't claim.
- No certification claims (SOC 2, ISO, HIPAA, PCI).
- No guarantee that a model or tool behaves as expected.
- No TLS interception — the proxy sees hostnames, not payloads. Rich detail comes from adapters, not decryption.
- Connector egress visibility covers calls that route through Aarmos, not every process on the machine.
- No hosted store of your prompts, tool inputs, or outputs.
Reporting a security issue.
Send reproduction steps — and a proof of concept if you have one — to support@aarmatix.com. We acknowledge reports promptly and will not pursue good-faith researchers.
Deeper control detail: Trust posture · Local runtime security model · Provenance & licensing
Next steps for review.
Two paths from here. Either one takes under an hour.