ASTRA / Security
Security and data
ASTRA runs inside your own accounts under credentials you grant and scopes you choose. Agent identity is least-privilege by default, consequential writes require a human, audit logs exclude user-typed content and personal data, and the model layer is yours to pick.
Pointing an autonomous system at revenue infrastructure is a security decision before it is a productivity one. These are the constraints that make it a reasonable one.
Whose accounts does it run in?
Yours. The workflows are built in your CRM, your automation tools and your repos. There is no separate Mindlyft system of record holding a copy of your pipeline, which means there is no second place for it to leak from and no migration if you leave.
What can an agent reach?
Only what you scoped. Agent identity is explicit: an agent is granted specific objects and fields on specific accounts, and it has no standing authority to widen that for itself. Least privilege is the starting position, not a hardening exercise after the fact.
What stops a bad write?
Three things in order. The scope, which means most bad writes are not reachable at all. The approval gate, which means consequential ones need a person. And the receipt, which means anything that did run can be found and reversed.
What goes into the logs?
Interaction patterns, not payloads. The audit trail records the action, the systems, the approver, the timestamps and the rollback path. User-typed content, passwords and personal data are deliberately kept out of it.
Which model processes our data?
The one you choose. ASTRA is model-agnostic and works with the OpenAI and Anthropic APIs among others, so the provider question is answerable by your own policy rather than by a vendor's default. The intelligence is swappable; the engineering around it is the durable part.
What happens if we stop the subscription?
The work keeps running. Because everything was built inside your accounts, cancelling ends the engineering relationship, not the automation. There is no minimum term, billing runs in 30-day cycles, and unused days bank and roll forward.
Who actually does the work?
Mindlyft, working with you directly. There is no account manager relaying requests to somebody you never meet.
Questions
Where does ASTRA store our data?
In your own systems. Workflows are built inside your CRM, automation tools and repos, so there is no separate Mindlyft copy of your pipeline.
What permissions does an ASTRA agent have?
Only the objects and fields you scope to it on the accounts you allow. Least privilege is the default and an agent cannot widen its own scope.
Can we bring our own model?
Yes. ASTRA is model-agnostic and works with the OpenAI and Anthropic APIs among others, so the provider decision follows your policy.
What is kept out of the audit logs?
User-typed content, passwords and personal data. The logs record the action, the approval and the target, not the sensitive payload.