Security is not a feature.
It is our architecture.
Our security posture is built from first principles.
Cryptographic controls protect the data layer, zero-trust governance protects execution, and isolated infrastructure controls underpin it all.
Every action earns the right to execute.
Photon evaluates identity, intent, risk, and organizational policy before an agent reaches an external system. Approval and audit are part of the execution path, not optional controls added afterward.
Identify
Resolve the user, agent, organization, and permitted capabilities.
Classify
Evaluate intent and action risk at the moment of execution.
Enforce
Apply role, data, rate, location, and organization policies.
Approve
Pause high-risk actions for explicit human authorization.
Execute
Run only the approved action with its bounded permissions.
Record
Capture the actor, policy verdict, outcome, and correlation ID.
Cryptographic Data Foundations
At the core of QuantumZero is a belief that security must be enforced at the data layer, not just at the network or application perimeter.
- ATOMIC ENGINE: Every sensitive record is stored as an AES-256 encrypted, self-describing ATOM — portable, governed, and policy-aware at rest and in transit.
- SEID (Searchable Encryption): Enables AI agents to execute queries against your data warehouse without ever decrypting the underlying data at the transport layer.
- PRISM: Field-level micro-perimeters that resolve dynamically at query time, ensuring data access is bounded by the caller's clearance — not just table-level permissions.
No participant receives more trust than it needs.
Gluon Link is Photon's credential security gateway. It separates the agent platform from connected services, keeps credentials encrypted until an approved request needs them, and reveals only the credential required for that specific service.
Agent Platform
Holds an encrypted credential container but cannot read the credentials sealed inside it.
Credential Security Gateway
Our Gluon Link gateway reveals only the required credential at the moment of use and enforces its attached policy.
Connected Service
Receives only the service-specific credential needed for the approved call, never the complete credential container.
A decision trail security teams can follow.
Security-relevant activity is recorded with enough context to reconstruct who acted, what was attempted, which policy applied, and what happened next.
When a skill runs, the activity trail identifies the script invoked and its resulting outcome. The script itself executes in Photon Sandbox, an isolated, time-bounded environment with ephemeral storage that is discarded after the request.
Operational answers, without the fine print.
Can users install arbitrary agent skills?
No. Skill installation is controlled by organization administrators, so available capabilities are an explicit organizational decision.
Can an agent bypass a high-risk approval?
No. The action remains paused until an authorized person approves it. If approval expires or is denied, the action does not execute.
Where are connected-service credentials stored?
Credentials are sealed in encrypted containers. When an approved tool call needs access, our credential security gateway reveals only the credential required for that service at the point of use.
What happens when policy blocks an action?
The request is stopped before the external system is called, and the policy verdict and attempted action are recorded for review.
Can administrators investigate agent activity?
Yes. Security-relevant activity records the actor, affected resource, policy decision, scripts and tools invoked, resulting outcomes, timestamps, and correlation identifiers.
How are skill scripts executed?
Each skill script runs in Photon Sandbox, an isolated, time-bounded execution environment with ephemeral storage. The execution environment is discarded when the request completes.
How is organization data separated?
Application data is namespaced by organization, with identity and access checks applied at service boundaries.
Responsible Vulnerability Disclosure
We welcome good-faith reports from security researchers. If you believe you have discovered a vulnerability in a QuantumZero product or service, please contact our security team. We will acknowledge your report, investigate it promptly, and coordinate remediation and disclosure where appropriate.