Task environment
The design provides a temporary environment per task, with resources defined in the run configuration and destroyed after the run. In deployment, verify disposal and separation between environments.
Assess access, data and records before expanding usage.
This page describes the platform's security model and what must be confirmed in the chosen deployment. Technical and contractual evaluation of the deployment must confirm how it works and where its limits are.
Security model and validation questions
Network
The design limits network destinations and records out-of-policy attempts. In deployment, verify the configured rules and the records of those attempts.
Credentials
The design scopes credentials to the flow and makes them available during the run. In deployment, verify how credentials are delivered during execution, when they stop being available to the environment and where they remain stored.
Data lifecycle
The design preserves inputs, results and events for review. The contract must define retention and deletion; confirm how those terms are met in the deployment.
Encryption
The design encrypts data in transit and at rest. Confirm the protocols, configuration, key management and deployment options in the technical and contractual scope.
Identity and access
The design provides per-user access and role-based permissions. Confirm the available roles and integration with your organization's login and directory.
Separation between organizations
The design keeps access, configuration and records separated per organization. Verify that separation in the applicable deployment.
Data processors
The list depends on the chosen infrastructure and providers. ContactLab provides the applicable list during scoping and updates it as contracted conditions change.
Privacy and data custody
Private by default
Runs and files start private to whoever created them. Sharing is explicit.
Customer-controlled persistence
Inputs, outputs, files, history and evidence can be persisted in customer-controlled AWS resources.
Cross-account AWS access with least privilege
The design provides cross-account AWS access restricted to what execution requires. Confirm the granted permissions in the applicable deployment.
ContactLab processes the execution but does not maintain permanent custody of execution content.
Audit and certifications
ContactLab is not SOC 2 or ISO 27001 certified and does not claim a completed independent audit. Evidence review and pilot terms do not replace an independent audit.
Vulnerability reporting
Report suspected vulnerabilities to jorleyoliveira@contactlabsolutions.com. Include reproduction details when possible. ContactLab acknowledges reports and coordinates fixes with reporters.
See a run and its records
In the 30-minute meeting, we present a live or previously prepared run in the ContactLab environment. You see the inputs, the result and the available records of the same run. Then we discuss your flow and what the pilot needs to assess.