Security
Control is a product feature, not a policy page.
OYYO is designed so that the sensitive parts of business work can stay under your control, by architecture rather than by promise.
Design principles
Local when it matters
A task marked local-only is designed to execute on your hardware, with no model call leaving the machine.
Explicit execution mode
Local, hybrid and cloud are visible states, not hidden defaults.
Scoped agent permissions
Agents receive the narrowest capability needed for the step in front of them.
Sandboxed execution
Code and tool use run inside isolated environments with bounded reach.
Approval gates
Irreversible or outbound actions require a human decision.
Audit trail
What ran, on what input, under which permission, producing which artifact.
Credentials should remain isolated from model context wherever possible. Tool outputs are treated as external content. A model suggestion does not become an authorized action. Effective permission is decided by policy, identity, scope and approval state.
Honesty
What we do not claim.
OYYO does not currently publish certifications, and no page on this site implies one. Compliance posture will be published when it is real and verifiable, not before.
Think. Create. Execute.
Questions about data handling?
Talk to the team directly.