What we secure, and what you operate.

The platform and the infrastructure it runs on:

• The on-premise appliance and its software, including keeping it up to date and securing the paths it uses to connect.
• The cloud services that back it, built on independently certified infrastructure (see Sub-processors & infrastructure).
• Encryption of your data in transit, and of your backups and footage at rest.
• The access-control, model-control, integration, backup and residency controls documented across this Trust Centre, and the central enforcement of the settings you choose.
• Continuous security operations on our own services: audit logging, centralised cloud security posture monitoring, perimeter and vulnerability scanning, and dependency monitoring.
• Vetting of integration partners before they reach production access.

How you use the platform to build and operate your solution:

• Your configuration. You decide who has access, what the agent can reach, which models are enabled, which integrations are on, where backups and footage are stored, and how long data is retained. We provide and enforce the controls; choosing the right settings for your use case is yours.
• Your people and devices. Managing your users, keeping their access credentials confidential, using the security features available to you, and securing the physical space your appliance is installed in.
• Secrets and material on the agent. Keys, passwords, tokens and other confidential data you place on an AI Agent - including through scripts, skills or workspace files - are under your control. Performance Hub encrypts and securely stores agent backups; if customer-configured agent behaviour exposes that material, that exposure is your responsibility. See Security architecture.
• Your integrations and partners. Third-party systems you connect are governed by those providers' own terms and policies. Performance Hub is not responsible for the functionality, security or policies of third-party services, nor for what a partner does with data once it is in their system. See Integrations, partners & data sharing.
• Your legal and regulatory obligations. Ensuring that how you collect, store and process personal information complies with the laws that apply to your organisation and jurisdiction, and obtaining any consents you need. For CCTV and biometric features, this includes signage, a lawful basis, and honouring deletion and opt-out requests.
• Backing up what matters to you. Backups are on by default and encrypted, but you are responsible for the retention and restore settings that match your obligations.
• What your agent builds and runs. Scripts, code, published apps, crons and schedules, and other agentic integrations your agent creates are yours to manage and operate. We can provide architectural guidance and help with prompt engineering and the overall shape of the solution, but how you deploy and run it remains your responsibility.
• The solution you operate. Performance Hub provides the platform and controls; the solution you assemble and operate, and its compliance, is yours.

This allocation is also set out in our Acceptable Use Policy, which governs use of the platform. Where this page and the legal terms differ, the legal terms prevail.