The confidence to recommend Aarmos internally.
One page, forwardable, that answers what a security reviewer asks: what Aarmos touches, what it doesn't, and what your team can verify without us. App-visible behavior only — never a certification claim.
Maintained by Aarmatix LLC, the maker of Aarmos. This page describes product behavior; it is not an audit, attestation, or independent verification.
What Aarmos assumes — and what it doesn't.
Aarmos assumes the operator's machine is trusted. It does not assume the network is trusted, the model provider is trusted, or that any tool the agent calls behaves as documented.
Aarmos does not claim to prevent every unsafe agent behavior. It claims that actions on governed paths pass an explicit policy decision, and that the decision is provable afterward.
Data boundary.
Aarmos is local-first. The policy gate runs on the operator's machine. Saved credentials and history are held on that machine; credentials, prompts, and tool inputs are sent to the configured provider or tool when used. Policy evaluation, receipt signing, and key custody never require our cloud.
What leaves the machine is only what the operator sends — the agent's own calls to whichever model or tool it was configured to reach. Aarmos does not phone home with agent content. Aarmos-hosted forwarding and provider sign-in for tools are currently unavailable. If you use a forwarder you run yourself, tool requests and their credentials pass through your infrastructure.
- Policy decisions and receipt signing run on-device.
- No agent prompts, tool inputs, or outputs sent to Aarmos.
- Workspace features (accounts, membership, entitlements, audit event envelopes) use our backend; payloads never do.
- Evidence forwarding to your SIEM is opt-in, admin-configured, and envelope-only.
- Local observation binds to loopback only; a browser joins with a single-use pairing code exchanged for a short-lived, read-only session.
Full data-flow detail lives in the privacy notes.
Independent verification.
Governed decisions on supported paths produce a signed Receipt. Receipts verify with a portable Apache-2.0 artifact that runs without Aarmos. Your team can audit, replay, or archive them years after the runtime is gone.
> await verifyReceipt(receipt)
ok · chain intact · policy pinned · signature valid
- Receipts are signed and tamper-evident.
- Verifier is portable and runs without network access.
- Verifier library is Apache-2.0 and publicly available on npm.
- No dependency on Aarmos uptime or goodwill.
Shared responsibility.
- Aarmos
- Policy decisions, Receipts, portable verifier, workspace governance features.
- App owner
- Policies, allow-lists, who gets access, incident process.
- Operator
- Machine trust, credentials, model and tool keys.
What we don't claim.
- No certification claims (SOC 2, ISO, HIPAA, PCI).
- No guarantee that a model or tool behaves as expected.
- No TLS interception — the proxy sees hostnames, not payloads. Rich detail comes from adapters, not decryption.
- Connector egress visibility covers calls that route through Aarmos, not every process on the machine.
- No hosted store of your prompts, tool inputs, or outputs.
Reporting a security issue.
Send reproduction steps — and a proof of concept if you have one — to support@aarmatix.com. Security inquiries are handled on a best-effort basis, with no response time promised. We will not pursue good-faith researchers.
Deeper control detail: Trust posture · Local runtime security model · Provenance & licensing
Next steps for review.
Choose the guided evaluation or inspect a supported artifact directly.