Security and data
Your clients' data stays with you.
Holon runs where you install it: on a computer at your agency, or on a server you control. There is no account on our side, and nothing is sent to us.
What Holon keeps
- For each call: the client, the agent or tool, when, the result, the cost, and the rule that blocked it or held it for approval.
- For each approval: who decided, when, and why it waited.
- Your clients, their rules, your team and its roles, your settings.
- Model costs per client and day, read from Anthropic or entered by you.
What it never keeps
- What an agent was asked, and what it answered: they pass through, and are not stored.
- An exception, by design: a call waiting for approval keeps its input until someone decides, so the person can see what they approve. It is deleted when decided, or after 7 days.
- Your API keys in clear text: Holon stores their fingerprint only, and shows a key once, when it is made.
How it is protected
- Secrets you give Holon (the token of an MCP server, a Slack webhook, an Anthropic admin key) are encrypted at rest (AES-256-GCM) and never shown again.
- Each client's key works for that client only, under its budget and rules. A client's agents cannot see or call another workspace's private tools.
- People have roles (admin, member, viewer). Removing someone, or changing their role, stops their access at once.
- Report links are signed, read-only, expire after 90 days, and can all be revoked at once for a client.
- A Slack webhook is only ever sent to Slack. Agents you connect are reached at public addresses only, never at addresses inside your network, unless you run everything on one machine for testing.
- Money is counted in exact integers, never rounded, and every movement is recorded once and cannot be edited.
The code
The core of Holon (the gateway that applies the rules and keeps the record) is open source, under the Apache 2.0 license: your security team can read what runs on your machine. The agency features are under a commercial license. The code is published at launch.
Found a security issue? Write to contact@useholon.com.