Security

ioReign holds your source code and lets AI agents act on it, so security is the product, not a feature. This page says what the beta includes, what is not done yet, and how to tell us about a problem.

ioReign is made by McAlpine Cyber and AI Pty Ltd, Sydney, Australia, a security company founded and led by Haden McAlpine, CISSP.

What the beta includes

ioReign is still being built. These are the protections the beta includes when it opens:

• Tenant isolation. Each organisation's data is kept in its own storage, named from the organisation's id. That id comes only from a verified token, never from the request path, and another organisation's repository answers exactly like one that doesn't exist. A cross-tenant test suite runs on every change we make.
• A scoped identity for each agent. Each agent gets its own identity with only the scopes you give it. Access tokens last 15 minutes at most, and you can revoke an identity at any time.
• Owner sign-in with passkeys. People sign in to the owner console with passkeys only. There are no passwords to steal or reuse.
• An append-only audit log. Each change records who made it (which agent or person) and when. There is no route, for you or for our staff, that edits or deletes an entry, until your organisation is deleted, as the privacy policy describes.
• Kill switches. A stop flag halts a single agent, or your whole organisation: while it is on, the API refuses that work and tells the agent to stop. The control for owners arrives with the beta, in the owner console.
• Staff access that is controlled and recorded. Our staff tools sit behind Cloudflare Access on a separate host, and staff actions are written to an audit log.
• Encryption. Your data is encrypted at rest by Cloudflare, and our site, API and Git are served over HTTPS.
• Where your data is stored. Your data is stored in the Asia-Pacific region where possible, on Cloudflare. Cloudflare does not guarantee a location in Australia, so we don't claim Australian hosting.

What is not done yet

We are in a small, paid design-partner beta, and we say plainly what that means:

• No external penetration test yet. An independent pen test happens before full launch. An internal security review is done before the beta opens.
• No full load test yet. Before the beta opens, we test at small scale only. Full-scale load testing happens before full launch.
• No service level agreement (SLA). We don't promise uptime or response times.
• No third-party security certifications yet. We will publish an Essential Eight statement before full launch.

Because of this, keep your own copy of anything important. Export makes that easy. The beta terms say the same.

Report a security problem

Email security@ioreign.ai, at any time. Please include what you found, where (the host and path), the steps to reproduce it, and what an attacker could do with it. Write in English if you can.

What you can expect from us:

• We acknowledge your report within 3 business days (Sydney, Monday to Friday, excluding NSW public holidays).
• We tell you whether we can reproduce it, and keep you updated until it is fixed.
• We agree a disclosure date with you. We ask for up to 90 days to fix a problem before it is made public.
• If you want to be named, we credit you once it is fixed.

We don't pay bug bounties during the beta.

Rules for good-faith research

If you act in good faith and follow these rules, we will not take legal action against you for that research:

• Test only against your own organisation's account, or against what anyone can reach without an account. Don't try to get into another organisation's account.
• If you reach data that isn't yours, stop, don't keep or share it, and tell us.
• Don't degrade the service for others: no denial of service, load testing, spam or flooding of forms.
• No social engineering of our staff or partners, and no physical attacks.
• Give us reasonable time to fix the problem before you tell anyone else.

This promise covers us, McAlpine Cyber and AI Pty Ltd. We can't make it for other companies, such as Cloudflare or Stripe; report problems in their services to them.

Our security.txt has the same contact details for tools that read it.