roles · teams
Access you can explain
Vault and workspace roles show who can edit, run, and read without inventing a separate security product.
loading
Loading content
Security
Trust holds for the life of the machine.
Each workflow step runs in its own container on a machine slot. Managed fleets supply short-lived compute; self-hosted fleets run on machines you enroll. Declared outputs and run records stay available after the containers are gone.
Isolation follows how a step runs
Managed or self-hosted fleets supply machine slots. Each step gets its own container. When the step finishes, the container goes; the records you kept stay.
01
Take a machine slot
Managed fleets supply short-lived machines for the run. Self-hosted fleets reserve machines you already enrolled.
02
Run each step in its own container
Every workflow step gets a fresh container with its own inputs, limits, and outputs. Jobs do not share a slot while they run.
03
Keep platform internals out of reach
Containers cannot reach cloud instance metadata or Trickest’s private 10/8 network. Managed fleets can use static outbound IPs for your allowlists.
04
Remove the step, keep what you recorded
When a step finishes, its container is removed. Declared outputs, logs, and run records stay available under your retention settings.
Your vault holds the run records
Workflows, run records, outputs, and secrets stay scoped to your vault. Transfers use HTTPS. Ask us for environment-specific encryption and retention details.
scoped to your vault
What Trickest stores for a run
Workflow definitions, run metadata, declared outputs, and structured Live Table data stay in your vault. Access follows vault and workspace roles.
Workflow outputs
Files and structured findings land in vault-scoped storage and transfer over HTTPS with time-limited signed URLs.
vault-scoped
Workflow definitions
Graphs and versions live with the workspace that owns them, so teams edit and run under the same access model.
versioned graphs
Secrets by name
Store secrets encrypted and reference them by name. Values are not returned by the settings API after you enter them. Update or delete a secret without rewriting every workflow.
personal or workspace scope
Access that matches how teams work
People and automation authenticate under vault and workspace roles. Tokens act as the user. Enterprise audit logs cover supported platform activity.
SAML single sign-on
Connect enterprise users through SAML 2.0. Individual users can add TOTP multi-factor authentication to password sign-in.
Roles that match how teams work
Assign vault and workspace roles to people or teams. Separate who administers, edits, runs, and only reads.
Personal API tokens
CLI, SDK, and API calls authenticate as the user. Regenerating a token invalidates the previous one.
Enterprise audit logs
Search, filter, and export records of supported authenticated platform activity when the audit feature is enabled.
Evidence for the reviews you already run
Use run history, roles, and audit exports in customer security reviews. Contact us for current assurance documentation and scope.
run history
Runs you can reconstruct
Execution records, outputs, and logs stay available so a review can follow what ran, when, and with which graph version.
reviews · export
Evidence for your process
Use platform records in customer security reviews. Ask us for current assurance documentation and scope.
Explore the platform
Execution is where steps run. Workflows and agents submit work into that model.
Get a personalized demo
See Trickest in Action
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.