Skip to content
XEVRION
Get started
Menu
ProductOverviewReviewProveControlObserveImproveHow it works
TeamsEngineeringSecurityComplianceOperations
CompanyAboutContactChangelogSecurity
ResourcesDocsGlossaryFAQPricingPrivacy

For security teams

Know exactly what your agents were allowed to do

Limit blast radius, protect owner actions with a second person, and stream every event to your own tools.

Get startedSee pricing →
app.xevrion.co.uk / settings / securityExample data
Actions with a check97%Last 30 days
Critical, auto-approved0Cannot happen
Agents at their limit1Paused
Events streamed12,480To your SIEM

Controls

  • SSO and SCIMOn
  • Two-person owner actionsOn
  • Encryption with your keyOn
  • Region pinned to UKOn

Agent limits

  • refund-agent36 of 50
  • support-agent10 of 50

Your jobs

What security gets done

  • Limit the damage

    Cap requests and spend per agent.

  • Guard the levers

    A second owner for the changes that matter most.

  • See it all

    Stream audit events to your SIEM.

Getting started

Your first week

  1. Day 1: set the ceilingsCap requests and spend for each agent.
  2. Day 2: protect the leversAsk for a second owner on policy and key changes.
  3. Day 3: pick the regionPin data to the UK, EU or US.
  4. Day 5: stream the eventsSend the audit log to your own tools.

Control

Blast-radius limits

Limit how many requests and how much spend a single agent may raise in a rolling window.

  • Requests and spendTwo dials per agent: how many, and how much money.
  • Enforced as it happensChecked when the request is created, so two at once cannot both slip through.
  • Signed attestationExport a signed statement of the limit and how full it is, for an auditor or insurer.
How Blast-radius limits works →
app.xevrion.co.uk / agents / refund-agent / limitsExample data

Used in the last hour

Rolling window
  • Requests raised36 of 50
  • Spend asked for£4,100 of £10,000
  • Critical actions0 of 2

Limit

Agent
refund-agent
Window
60 minutes
At the limit
Pause the agent
Attestation
Signed hourly

If the agent loops

  1. Request 50 raised
  2. Request 51 refusedlimit reached
  3. Owner told in Slack
  4. Signed note of what was refused

Control

Two-person approval

Sensitive owner actions wait for a second owner to agree. Their approval works once, for that exact call.

  • Covers the big leversRetention, legal hold, erasure, single sign-on, log export, roles, limits and region.
  • One use onlyThe grant is tied to the exact call and lasts an hour.
  • Both names recordedWho asked and who agreed are in the log.
How Two-person approval works →
app.xevrion.co.uk / settings / owner-actionsExample data

Waiting for a second owner

Owner actions
  • Change region to EUAsked by Dan R.1 of 2
  • Turn off two-person approvalAsked by Dan R.1 of 2
  • Export all decisionsAsked by Mia K.Done

Change region to EU

First owner
Dan R. · 11:02
Second owner
Waiting
Their approval
Works once, for this call
Recorded
Both names, signed

Always needs two

  • Region changes
  • Key changes
  • Role and SSO changes
  • Policy switch-off

Platform

Audit streaming

Stream audit events to the SIEM you already use, so security sees review activity next to everything else.

  • Your toolsEvents land where your security team already looks.
  • Every eventDecisions, changes and refusals.
  • Verified at both endsThe hash chain lets you check what arrived.
How Audit streaming works →
app.xevrion.co.uk / settings / streamingExample data

Destinations

  • Security data lakeHTTPS · signed batchesLive
  • SIEM collectorHTTPS · 12,480 sent todayLive
  • Archive bucketDaily filesPaused

One event

  1. Decision made
  2. Signed and queued
  3. Delivered, receiver verified
  4. Retried if it failed

Event

{ type: 'review.decided',  agent: 'refund-agent',  outcome: 'approved' }

Control

Encryption and your own key

Turn on encryption for stored review data. Enterprise can hold the key in a service you run.

  • Own data keyEach organisation gets its own key. Requests, events, replies and attachments are sealed.
  • Your key, if you want itA key service you run can lock the data key. Revoke it and access stops.
  • Destroy to eraseDestroying the keys makes the sealed data unreadable.
How Encryption and your own key works →
app.xevrion.co.uk / settings / encryptionExample data

Encryption at rest

Review data
Status
On
Data key
Own key for your organisation
Algorithm
AES-256-GCM
Key held by
Your key service (Enterprise)

Wrap, store, read

  1. Fresh data key per organisation
  2. Key wrapped by your key
  3. Payloads stored encrypted
  4. Destroy the key to erase

Stored value

payload: enc1.k_4f2e.7a9f…c2.0d41…e9b6// prefix, key id, nonce, ciphertext// opened only with your key

Control

Region pinning

Pin your organisation to a region. Every other region refuses its requests, and a signed note says where it runs.

  • A database per regionUK, EU and US each have their own database, storage and queue.
  • Other regions say noA request that lands in the wrong region is refused, not quietly served.
  • Move with a checkA tool moves an organisation between regions and proves the copy matches before the old one is removed.
How Region pinning works →
app.xevrion.co.uk / settings / regionsExample data

Regions

One database each
  • United KingdomPinned for Acme SupportHome
  • European UnionWould refuse these requestsRefuses
  • United StatesWould refuse these requestsRefuses

Request from the wrong region

  1. Reaches the EU region
  2. Not your home region
  3. Refused, nothing stored

Signed note

Runs in
United Kingdom
Since
2 Mar 2026
Signature
Valid

Control

SSO, SCIM and roles

Sign in with your own identity provider, provision people automatically, and give each role only what it needs.

  • Single sign-onOIDC with your identity provider. Reviewers use the account they already have.
  • SCIM provisioningPeople are added and removed from your directory, not by hand.
  • Custom rolesDefine who can decide, at what risk level, and who can change settings.
How SSO, SCIM and roles works →
app.xevrion.co.uk / settings / peopleExample data

People

Synced from your provider
  • Priya N.priya@acme.exampleReviewer
  • Sam O.sam@acme.exampleReviewer
  • Mia K.mia@acme.exampleAuditor
  • Dan R.dan@acme.exampleOwner

What each role can do

RowDecideEdit policyExport
Reviewer
Auditor
Policy author
Owner

Leaver in your directory

  1. Removed in your provider
  2. Access ends here too
  3. Open reviews reassigned

Questions

What security teams ask first

What stops one agent doing too much?

You set caps on requests and spend for each agent, so one mistake has a ceiling.

Who can change the rules?

Protected actions, such as changing a policy, can need a second owner, so one person alone cannot make the change.

Where does the data live, and who can read it?

In the region you pick: UK, EU or US. Stored review data is sealed for each organisation with AES-256-GCM, and Enterprise can use its own key.

Can events reach our SIEM?

Yes. Audit events stream to your own tools as they happen.

Know what your agents did.

Start free. Guard your first agent in a few minutes, and keep a record anyone can check.

Get started freeSee pricing →
  • Free plan, no card
  • Signed, chained decisions
  • Checked offline, without us