Scope enforcement
Targets come from the engagement record. Out-of-scope targets are refused — a wandering session cannot leave authorized scope.
TRUST & GOVERNANCE
Autonomy inside explicit boundaries.
Autonomous research only belongs in production when it is bounded. 0day Factory treats scope, identity, evidence and human control as first-class — enforced in the product, not promised in a slide.
Six boundaries around every investigation.
Identity & least privilege
Separate agent identities, short-lived scoped credentials and non-admin roles. A developer token is not an agent identity.
Organizational policy
Prohibited actions, environment and data-access limits, destructive-action restrictions and human-approval boundaries are honored.
Evidence & audit
Every action is recorded. That trail is the engagement's evidence of authorization — readable, never obscured.
Human control
Approval gates where you want them, and cancel at any time. Autonomy is narrow by default.
Tenant isolation
Multi-tenant data is isolated at the database layer with row-level security, proven by an isolation test suite in CI.
The audit trail is a feature, not a risk.
Secret hygiene is in scope: credentials are short-lived and scoped, logs are redacted before they leave a worker, and no inbound listener runs on the machine. Opacity to a defender is not in scope.
The trail is what demonstrates an engagement was authorized when a client or an internal security team asks what ran on their host. Where a scanner spawns compilers or probes networks, the worker is allowlisted with the security team — never designed to evade detection.
Compliance is earned, not asserted.
We describe the technical controls the product actually provides: row-level tenant isolation, role-based access control, immutable audit, MFA, data export and erasure, and secret handling in a vault.
We do not claim certifications before independent verification. Formal attestations are process deliverables; where they apply, we will state status honestly rather than imply it.
Questions, answered.
How is multi-tenant data isolated?
Isolation is enforced in the database with row-level security keyed to each organization, privileged writes go through audited server-side functions, and a tenant-isolation test suite runs in CI on every change.
Can an autonomous agent act outside my scope?
No. The worker refuses any target not present in the authorized task spec, and every action is recorded. Scope enforcement is a control, not a guideline.
Do you hold certifications?
We state certification status honestly and do not imply attestations we have not independently earned. The underlying technical controls (isolation, RBAC, audit, retention, secret hygiene) are in place as the evidence those processes rely on.
Security autonomy you can actually authorize.
Request access and see a de-identified investigation: hypothesis, path, safe validation, evidence and re-test.