Security at Gauntlet

A summary for vendor reviews. The binding terms are in the DPA (Annex 2).

Test environment isolation

Isolation: One Kubernetes namespace per environment, with a resource quota, Pod Security baseline and no LoadBalancer or NodePort services. Helm-chart apps also run in their own virtual cluster in that namespace.
Network: Inbound only from the environment itself and the platform. Outbound: DNS, the platform API, the Kubernetes API and the public internet. Other private addresses, other environments and the cloud metadata service are blocked.
Runtime: Gauntlet Cloud runs the agent and container apps (Dockerfile, compose) under gVisor. A Helm-chart app's pods run on the default runtime (runc), isolated by its virtual cluster, namespace, network policy and quota. Self-hosted: the same split with the runtime class you set (gVisor, Kata), or your cluster's default.
Lifetime: Deleted with its namespace when its time limit runs out (2 hours to 7 days, by plan).

Model keys: Stored encrypted (AES-256-GCM, a fresh data key per value). They never enter an environment: the agent's model calls go through Gauntlet's proxy with a per-run token.
Tokens: API tokens, run tokens and sign-in links are stored only as SHA-256 hashes.
What leaves: Model calls go to your provider with your key, and carry page content, screenshots and logs from the environment. Gauntlet Cloud has no key of its own to fall back on.
Masking: Credentials in the text a run reports are masked before storage; video, screenshots and traces are not.
Retention: Runs and their artifacts (screenshots, recordings, logs) stay until you delete the run or its project.

Gauntlet Cloud: AWS eu-north-1 (Stockholm), on a single server: no high-availability commitment. Encrypted disk and Kubernetes Secrets; weekly snapshots, four kept. Sign-in by invitation.
Self-hosted: Run data stays on your cluster. What goes out: model calls, and a daily license renewal to this site (installation ID and current license; off when air-gapped). No telemetry.
Cluster access: Self-hosted Gauntlet is cluster-admin by default, to create each environment's namespace on the fly; rbac.clusterAdmin: false uses a narrower cluster-wide role (details).
Certifications: None yet (no SOC 2 or ISO 27001).

Email hello@usegauntlet.dev with the steps to reproduce, and keep it private until we have fixed it.
Test only with your own account, environments and installation: no access to other customers' data, no denial of service, no automated scanning of Gauntlet Cloud.
Good-faith research within these rules is authorized under our Terms, and we won't take legal action over it.