CrowsNest Trust Center
A technical overview of tenant isolation, provider permissions, sensitive-content handling, credential protection, AI-agent boundaries, retention and audit evidence.
Compliance foundation
CrowsNest is hosted on Oracle Cloud Infrastructure (OCI) and Google Cloud, where Flying Cloud is an authorized Oracle Partner Network member and Google Cloud Partner. Both platforms maintain independently audited SOC 2 Type II certification for the infrastructure layer. Flying Cloud self-attests to the application-level security controls—tenant isolation, credential handling, encryption and access control—that it builds on top of that certified foundation. Security and procurement teams evaluating CrowsNest under a shared-responsibility framework can request Flying Cloud’s infrastructure inheritance summary alongside the materials below.
Report suspected vulnerabilities to sales@flyingcloudtech.com; reports are routed directly to the engineering and security team.
Customer data is processed within the customer’s connected Google Workspace or Microsoft 365 tenant region and Flying Cloud’s OCI/Google Cloud hosting regions. Specific residency requirements can be discussed during evaluation.
Enterprise agreements can include negotiated uptime and incident-response commitments. Current published plans do not include a self-service SLA; contact Flying Cloud to discuss Enterprise terms.
Independent assurance and procurement status
CrowsNest runs on Oracle Cloud Infrastructure and Google Cloud infrastructure that Flying Cloud identifies as SOC 2 Type II certified at the infrastructure layer. Flying Cloud does not publish a standalone application-level SOC 2 or ISO 27001 certification for CrowsNest on this site. Do not interpret infrastructure certification as a Flying Cloud application certification.
/.well-known/security.txt
Security-review rule: if a certification, test report, contractual term or service commitment is not listed above, do not infer it. Flying Cloud will provide the current status during evaluation.
Security model
CrowsNest mediates access between supported providers, customer-authorized users and registered AI agents. Provider credentials remain inside the CrowsNest service. Agent credentials are tenant-bound and capability-scoped. For replies routed through the Agent Email Proxy, CrowsNest evaluates authorization and policy before invoking provider transport.
Data minimization
CrowsNest fetches email bodies and attachment bytes from the customer’s provider when analysis is required. Raw email bodies and attachment contents are not retained as a separate CrowsNest content repository. Findings, cryptographic fingerprints and relevant metadata are retained under tenant-configurable retention settings.
CrowsNest applies tenant routing and tenant-scoped queries throughout the application, including per-tenant database pools and cross-tenant authorization controls. Agent actions are bound to the tenant that issued the agent credential.
Connections to providers and managed databases use TLS. Provider-managed encryption protects managed storage at rest, while connector credentials and BYOK keys receive application-layer AES-256-GCM encryption. Plaintext Agent Email Proxy API keys are not retained; one-way representations support authentication, rotation and revocation.
Standard Google Workspace analysis uses read-only Gmail and directory scopes. Gmail send permission is requested only for authorized Agent Email Proxy replies. Microsoft 365 uses app-only Microsoft Graph permissions; SharePoint and OneDrive analysis require documented tenant-wide file and site read scopes.
The Agent Email Proxy separates read-thread and send-reply capabilities, restricts replies to existing thread participants, prohibits BCC, applies pre-send policy and keeps agent sending disabled by default.
Core detection uses stored rules, entity-recognition ML, validated patterns, OCR and similarity analysis. An optional natural-language rules assistant can use selected third-party model providers with provider routing, BYOK support and masked-snippet controls.
CrowsNest supports tenant-configurable retention from 1 to 3,650 days, with scheduled pruning and orphan cleanup. Retention settings apply to the findings and metadata CrowsNest retains.
Agent Email Proxy reads, policy decisions, blocked replies and completed sends are audit-logged with the available agent, request, content-fingerprint and outcome context.
CrowsNest provides an email-action enforcement boundary. Customers should combine it with identity controls, model and runtime safeguards, prompt-injection defenses and their existing incident-response program.
For a contractual subprocessor list, data-processing terms, applicable regions and any provider changes, use the security-review process before production deployment.
CrowsNest publishes its active retention model for findings and metadata (1 to 3,650 days) and states that raw email bodies and attachment contents are not retained as a separate repository. Buyers should also confirm their required export format, deletion timing after termination, backup lifecycle, legal-hold needs and any data-residency requirements in the applicable evaluation and contract.
Security, privacy and procurement teams can request the current permission matrix, architecture summary, infrastructure compliance-inheritance summary, data-handling description and deployment walkthrough from Flying Cloud. For company vitals, leadership and patent portfolio, see About Flying Cloud.