Security at Naptic

Naptic builds AI agents on Amazon Web Services, with each client deployed as its own isolated set of resources and Claude models running on Amazon Bedrock by default. AWS account activity is logged, data is encrypted at rest, and a person approves each release before it goes live.

Request our security overview naptic-guard on GitHub

Where your agents run

Agents run in AWS accounts that Naptic operates.
Each client is deployed as its own tenant: separate stacks, data stores and sign-in, built from one shared template. Shared platform records are kept separate by client.
A dedicated AWS account for your organization is available when your requirements call for it.

How your data is handled

Your data stays yours under our master services agreement, on every plan.
Data is stored in AWS services (DynamoDB and S3) and encrypted at rest.
Secrets and API keys live in AWS Secrets Manager, never in code.
AWS CloudTrail records account activity in our accounts, and production logs are kept for 365 days.

Which models we use

Agents use Anthropic Claude models through Amazon Bedrock by default.
If a project needs a provider outside AWS, we name it in your statement of work before anything is built.

Guardrails and prompt-injection filtering

Agents get an Amazon Bedrock Guardrail by default, with a high-strength prompt-attack filter against prompt injection and jailbreaks.
People approve each release: we fix what reviews find, and you approve before anything goes live.

SOC 2 status

Our platform is designed around SOC 2 controls, with a written control mapping and security policies.
We have not yet completed a SOC 2 audit. Ask us for the current control mapping.

naptic-guard, our open-source guardrail check

naptic-guard is a free, MIT-licensed command-line tool that audits Amazon Bedrock Guardrails.
It checks three things: a PII policy exists, the prompt-attack filter is on, and credentials are blocked rather than masked.

Last updated October 10, 2026. Questions: jordan@synapticstack.ai