---
title: "Security"
description: "Guild has completed a SOC 2 Type 1 audit. The report, DPA, subprocessors and controls are in the trust center. Agents run without seeing credentials, under policy on every outbound call, with scoped API keys and audit logs."
canonical: "https://www.guild.ai/security"
---

# Security

Guild has completed a SOC 2 Type 1 audit. The report, DPA, subprocessors and controls are in the trust center. Agents run without seeing credentials, under policy on every outbound call, with scoped API keys and audit logs.

[Visit the trust center](https://trust.guild.ai/)

## SOC 2 Type 1

The audit report is available on request.

[Request the report](https://trust.guild.ai/resources)

## Data Processing Agreement

Our DPA is published in the trust center.

[Read the DPA](https://trust.guild.ai/resources)

## Subprocessors

The third parties that process data for Guild, and what each one does.

[See subprocessors](https://trust.guild.ai/subprocessors)

## Controls

Tracked in the trust center across five areas:

- Infrastructure security
- Organizational security
- Product security
- Internal security procedures
- Data and privacy

[View all controls](https://trust.guild.ai/controls)

## Report a vulnerability

Send the details to our team inbox. Security questions go there too.

[hello@guild.ai](mailto:hello@guild.ai)

## How Guild keeps agents safe

Every call an agent makes to an outside service or model passes through Guild, where policy is checked and the call is recorded.

[Security architecture](https://docs.guild.ai/platform/security-architecture)

### Agents never see credentials

Guild adds credentials server-side after a policy check. They never enter the agent's code, container or prompt.

[How credentials work](https://docs.guild.ai/platform/security-architecture#secretless-execution)

### Policy on every outbound call

Tool calls are checked against credential policies, model calls against an allowlist and a daily token limit. Deny wins over allow.

[Credential policies](https://docs.guild.ai/platform/credential-policies)

### Scoped API keys

Set No access, Read or Read & write for each of six resource groups. No key can reach another account, billing or credentials.

[API keys](https://docs.guild.ai/platform/api-keys)

### Audit trail

A tamper-evident audit log of admin changes, and a session log of every model and tool call.

[Audit logs](https://docs.guild.ai/insights/audit-logs)