Ace
SOC 2 Type II report availableTrust center ↗

Security and privacy

Ace investigates production with read-only access and changes nothing without a plan your team approves. This page covers how we protect your systems, your data and the decisions made on them.

Compliance

Ace is built and operated by Vratix, Inc. Reports, policies and our security questionnaire are available through the trust center.

  • SOC 2 Type IICovers Vratix, Inc., the company that builds and operates Ace
    CompliantView report ↗
  • GDPRData processing terms and subprocessors in the trust center
    CompliantView details ↗

What Ace can reach

Every connection has its own identity and scope. Reading never implies permission to change anything.

  • AWSRead-only role

    Reads resource configuration and relationships, plus CloudWatch, X-Ray and CloudTrail data. Secret values, decryption and sensitive data-plane access are explicitly denied.

  • KubernetesOutbound connector

    Your cluster API is never exposed. Each cluster has its own identity and namespace scope. Changes use a separate identity you grant, and Secret values never enter evidence.

  • GitHubSelected repositories

    The Ace GitHub App reaches only the repositories you choose. Opening a pull request needs write access there. Your team merges.

  • DatadogCredentials you provide

    Queries metrics, logs and traces with a key you scope to read access.

  • PrometheusNamed workspace

    Query permissions are scoped to the Amazon Managed Prometheus workspace you connect.

  • SlackChannels you choose

    Posts investigation updates and approval requests. Approvals can be given in Slack. Replies in Ace threads are redacted for secrets, card numbers, bank and phone numbers before they are stored.

  • ConnectorsTokens you scope

    Sentry, Grafana, Axiom, LiteLLM, Vercel, Trigger.dev, PostHog and PlanetScale use credentials you provide, with optional project or dataset allowlists. Webhooks are verified. Writes such as a Vercel rollback need an administrator's grant first, and PlanetScale reads use a read-only password.

  • Ace MCP serverRead-only tokens

    Gives coding agents incident context and search. Tokens are scoped to your organization, expire after 90 days by default, are rate-limited, and every call is logged.

How changes are approved

Start read-only and widen the scope when your team is ready.

  1. 01
    Shadow mode first

    New organizations start in shadow mode. Ace records what it would do, without doing it.

  2. 02
    Approve the exact plan

    Approval is bound to the displayed plan. If the plan changes, it needs approval again.

  3. 03
    Production needs an approver

    Production changes need an administrator or a member an administrator has granted that action and environment. Ace mentions the approvers in Slack when someone else tries.

  4. 04
    Automatic execution is earned

    It applies to one confirmed workload and destination, and only after verified recoveries with no worsened outcomes. Daily caps apply, and each run is announced in Slack with a cancellation countdown.

  5. 05
    A record of everything

    Decisions, policy changes, executions and recovery results are kept in an append-only audit trail.

Controls

See all controls ↗

Access

  • Investigations use read-only access
  • Each integration has its own scoped permissions
  • You choose every source, repository and namespace

Change control

  • Every change is a plan your team approves in full
  • A changed plan needs a new approval
  • Automatic execution is a separate policy you can turn off

Data

  • Secret values and decryption are denied in AWS
  • Kubernetes Secret values never enter evidence
  • Retention is confirmed during your security review

Organization

  • 25 policies and 35 continuously monitored controls
  • Background screening, onboarding and offboarding
  • Security questionnaire available on request

Subprocessors

View all subprocessors ↗
  • AnthropicLarge language models
  • OpenAILarge language models
  • AWSCloud infrastructure
  • Google CloudCloud infrastructure
  • GitHubSource control and delivery

Questions

Documents

Request access through the trust center.

Report a vulnerability

Send a description and steps to reproduce. Please leave credentials and customer data out of your first message. We will arrange a secure channel for anything sensitive.