Regulated teams automate too. The data just never leaves.
Financial, healthcare, and public-sector teams want agent automation, and their security reviews arrive as written questions: where does the data go, who holds the keys, what is stored. Privent's answer is architectural, and the whole stack runs inside your network.
A regulated team does not get to trade data residency for automation. The security review asks where every byte goes, and an architecture that ships data to a vendor cloud fails the first question, whatever the vendor promises about it.
The only durable answer is a boundary the reviewer can draw: the workflow engine, the detection stack, and the evidence all inside the network they already control.
We are allowed to automate. We are not allowed to explain a data flow we cannot draw.
The stack lands inside
Backend, vault, ML scoring, and the document engine deploy in your infrastructure. The document engine makes zero outbound calls; OCR models are mounted, never downloaded.
The engine is swapped, not wrapped
The interceptor is a Privent build of the n8n image: one image swap on main, worker, and webhook, and every node in every workflow is covered inside your network.
Privent Tokenize
Sensitive values become typed, reversible tokens before any model call. Even a private model sees placeholders unless a trusted sink restores them.
The model call stays yours
External or private, the model receives tokenized text. What crosses any boundary is your decision, recorded per run.
Privent Detokenize
Placed before trusted egress points. Destinations outside your trusted-sink list keep the token instead of the original value.
Evidence for your own auditors
Audit records risk score, category, decision, and timestamp, without storing the raw prompt. Your compliance team exports and attests the report themselves.
Teams who must answer a written review before any automation touches production data, and want the answers to be architectural.
Engineers already running n8n inside the boundary who want protection that deploys the same way their stack does.
Teams who need exportable, attestable records of what the automation did, produced inside their own environment.
Self-host and air-gap are supported deployments of the same stack, not a special edition. The document engine runs with no outbound network at all.
Raw prompt and agent payload text is never stored; it is processed in memory only, and detection events keep metadata: risk score, category, decision, timestamp.
Compliance reports are generated, attested, and exported inside your environment, mapped per control, ready for your own auditors.
The security overview page answers the four key-management questions in writing, including what does not exist yet, because a plain absence reads better in a review than a hedge. Self-hosted deployments that don't configure a vector store persist nothing beyond event metadata.
SOC 2 Type II is in progress; our current controls and policies are public at trust.privent.ai. Compliance reports provide point-in-time operational evidence, not an audit opinion.
The answers on the security overview are the same ones we give in writing. A demo walks your review through them against a live self-hosted stack.
No production data is needed for the first conversation.
Privent provides operational evidence of data handling in automated workflows and supports self-hosted and air-gapped deployment. It does not provide legal advice, and its reports do not replace your organization's own compliance obligations, risk assessments, or independent audits.