From e648b787c56fe2f727d74841a8d1890a790c06e2 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Wed, 11 Nov 2026 19:43:09 +0000 Subject: [PATCH 1/2] docs: remove unsupported compliance promises and persist approval policy --- .../references/compliance-claims-policy.md | 18 ++++++++ .agents/references/doc-quality-policy.md | 2 + .agents/skills/draft_conceptual/SKILL.md | 2 + .agents/skills/draft_docs/SKILL.md | 2 + .agents/skills/draft_faq/SKILL.md | 2 + .agents/skills/draft_feature_doc/SKILL.md | 2 + .agents/skills/draft_guide/SKILL.md | 2 + .agents/skills/draft_procedural/SKILL.md | 2 + .agents/skills/draft_quickstart/SKILL.md | 2 + .agents/skills/draft_reference/SKILL.md | 2 + .agents/skills/draft_troubleshooting/SKILL.md | 2 + .agents/skills/review-docs-pr/SKILL.md | 2 + AGENTS.md | 4 ++ .../docs/agents/getting-started/faqs.mdx | 2 +- src/content/docs/agents/index.mdx | 2 +- .../inference/bring-your-own-api-key.mdx | 6 +-- .../inference/custom-inference-endpoint.mdx | 4 +- .../agents/inference/grok-subscription.mdx | 2 +- .../docs/agents/inference/model-choice.mdx | 23 ++-------- .../architecture-and-deployment.mdx | 23 ++++------ .../byollm-aws-bedrock.mdx | 12 +---- .../byollm-gemini-enterprise.mdx | 8 ++-- .../team-managed-keys-and-endpoints.mdx | 2 +- src/content/docs/enterprise/index.mdx | 4 +- .../security-overview.mdx | 46 +++++++------------ .../security-and-compliance/trust-center.mdx | 34 ++++---------- .../team-management/admin-panel.mdx | 11 ++--- .../self-hosting/security-and-networking.mdx | 4 +- src/content/docs/platform/architecture.mdx | 8 ++-- .../plans-and-billing/pricing-faqs.mdx | 28 ++++------- .../privacy-and-security/privacy.mdx | 6 +-- 31 files changed, 113 insertions(+), 156 deletions(-) create mode 100644 .agents/references/compliance-claims-policy.md diff --git a/.agents/references/compliance-claims-policy.md b/.agents/references/compliance-claims-policy.md new file mode 100644 index 000000000..3e332baba --- /dev/null +++ b/.agents/references/compliance-claims-policy.md @@ -0,0 +1,18 @@ +# Compliance claims policy + +Apply this policy when writing, reviewing, or answering questions from Warp documentation and other customer-facing content, including content about Oz and the Automation Platform. + +Warp is not HIPAA compliant. Omit HIPAA from customer-facing content and never imply that Warp or Oz supports HIPAA-regulated workloads or offers a HIPAA business associate agreement. + +Include other certifications, attestations, or compliance commitments only when a current Warp Security or Legal-approved source confirms the exact claim and its scope. Omit unsupported claims and flag them internally. + +Before retaining or adding a claim: + +* Record the approved source, its date or revision, the approving Security or Legal authority, and the exact product, plan, provider, model, deployment, and data scope it covers in the PR evidence. +* Distinguish an attestation from a certification, provider-side retention from Warp storage, and technical controls from contractual commitments. Do not infer compliance from encryption, self-hosting, a provider's certification, or a telemetry setting. +* Do not treat existing docs, source code, a generated draft, a positioning document, a sales or support statement, or a general PR approval as Security or Legal approval. +* Omit a claim when its approval, currency, or scope cannot be established. Report the omitted claim and missing evidence in the internal handoff or PR's `Unverified claims` section, without exposing confidential source material. Do not leave the unsupported promise in public prose with a `VERIFY` marker. + +For review, request changes if customer-facing content violates this policy. An ordinary documentation-risk waiver does not authorize a compliance claim. + +This versioned policy is durable repository guidance, not a write to platform-managed Agent Memory. diff --git a/.agents/references/doc-quality-policy.md b/.agents/references/doc-quality-policy.md index 8978be36f..91b21d75f 100644 --- a/.agents/references/doc-quality-policy.md +++ b/.agents/references/doc-quality-policy.md @@ -15,6 +15,8 @@ document is the single source of truth for the *rules*; the code enforces them. ## Scope +Compliance claims follow `.agents/references/compliance-claims-policy.md`. This is an exception to generic source verification and `VERIFY` handling: source code or existing docs cannot establish Security or Legal approval. Omit unsupported compliance promises from public content, flag them in the PR evidence, and request changes when they remain. A Docs override does not replace the required approval. + This program covers every agent-authored content PR in `warpdotdev/docs` — `draft_*`, `release_updates`, AEO, `missing_docs`, and any other recurring skill that adds or changes public documentation. It is not limited to ambient diff --git a/.agents/skills/draft_conceptual/SKILL.md b/.agents/skills/draft_conceptual/SKILL.md index 43b790a07..5039f4260 100644 --- a/.agents/skills/draft_conceptual/SKILL.md +++ b/.agents/skills/draft_conceptual/SKILL.md @@ -9,6 +9,8 @@ Draft a conceptual documentation page that explains what a feature or concept is ## Workflow +Read and apply `.agents/references/compliance-claims-policy.md` before drafting, including its omission and internal-reporting rules. + Follow the workflow in `.agents/skills/draft_docs/SKILL.md`, using the **conceptual template** at `.agents/templates/conceptual.md`. ## Frontmatter description diff --git a/.agents/skills/draft_docs/SKILL.md b/.agents/skills/draft_docs/SKILL.md index d4270d6f2..607ce32ce 100644 --- a/.agents/skills/draft_docs/SKILL.md +++ b/.agents/skills/draft_docs/SKILL.md @@ -118,6 +118,8 @@ Once the content type is identified: Read 2-3 strong examples in the target section to match existing patterns and conventions. ### 6. Research source code (if needed) +Before verifying claims, read and apply `.agents/references/compliance-claims-policy.md`. Omit HIPAA and unsupported compliance promises from customer-facing content; record missing Security or Legal approval in the internal handoff or PR evidence, not a public `VERIFY` marker. This exception overrides the generic source and marker options below. + For technical accuracy, optionally look in Warp's source repositories: - **warp-internal** - Client-side code (Rust, Swift, etc.) - **warp-server** - Server-side code (Go) diff --git a/.agents/skills/draft_faq/SKILL.md b/.agents/skills/draft_faq/SKILL.md index 756cf0e20..dd434f4a5 100644 --- a/.agents/skills/draft_faq/SKILL.md +++ b/.agents/skills/draft_faq/SKILL.md @@ -28,6 +28,8 @@ If the rules do not all hold, say so and redirect: ## Workflow +Read and apply `.agents/references/compliance-claims-policy.md` before drafting, including its omission and internal-reporting rules. + Follow the workflow in `.agents/skills/draft_docs/SKILL.md`, using the **FAQ template** at `.agents/templates/faq.md`. ## Frontmatter description diff --git a/.agents/skills/draft_feature_doc/SKILL.md b/.agents/skills/draft_feature_doc/SKILL.md index 02a0dafb7..ed6e678f1 100644 --- a/.agents/skills/draft_feature_doc/SKILL.md +++ b/.agents/skills/draft_feature_doc/SKILL.md @@ -9,6 +9,8 @@ Draft a feature documentation page that combines conceptual and procedural conte ## Workflow +Read and apply `.agents/references/compliance-claims-policy.md` before drafting, including its omission and internal-reporting rules. + Follow the workflow in `.agents/skills/draft_docs/SKILL.md`, using the **feature-doc template** at `.agents/templates/feature-doc.md`. ## Frontmatter description diff --git a/.agents/skills/draft_guide/SKILL.md b/.agents/skills/draft_guide/SKILL.md index a66d4b5c2..fa5b739af 100644 --- a/.agents/skills/draft_guide/SKILL.md +++ b/.agents/skills/draft_guide/SKILL.md @@ -20,6 +20,8 @@ Tutorials are more conversational than other content: a developer-to-developer c ## Workflow +Read and apply `.agents/references/compliance-claims-policy.md` before drafting, including its omission and internal-reporting rules. + Follow the workflow in `.agents/skills/draft_docs/SKILL.md`, using the **guide template** at `.agents/templates/guide-page.md`. Guide pages live in `src/content/docs/guides/` (the Guides Astro Starlight space), not in the main product reference sections. When placing the file, use these directories: diff --git a/.agents/skills/draft_procedural/SKILL.md b/.agents/skills/draft_procedural/SKILL.md index c8459773e..09b4b3907 100644 --- a/.agents/skills/draft_procedural/SKILL.md +++ b/.agents/skills/draft_procedural/SKILL.md @@ -9,6 +9,8 @@ Draft a procedural documentation page with step-by-step instructions to accompli ## Workflow +Read and apply `.agents/references/compliance-claims-policy.md` before drafting, including its omission and internal-reporting rules. + Follow the workflow in `.agents/skills/draft_docs/SKILL.md`, using the **procedural template** at `.agents/templates/procedural.md`. ## Frontmatter description diff --git a/.agents/skills/draft_quickstart/SKILL.md b/.agents/skills/draft_quickstart/SKILL.md index 09e6ce701..99eb4787f 100644 --- a/.agents/skills/draft_quickstart/SKILL.md +++ b/.agents/skills/draft_quickstart/SKILL.md @@ -17,6 +17,8 @@ A tutorial for a product area requires that its quickstart already exist. If you ## Workflow +Read and apply `.agents/references/compliance-claims-policy.md` before drafting, including its omission and internal-reporting rules. + Follow the workflow in `.agents/skills/draft_docs/SKILL.md`, using the **quickstart template** at `.agents/templates/quickstart.md`. ## Frontmatter description diff --git a/.agents/skills/draft_reference/SKILL.md b/.agents/skills/draft_reference/SKILL.md index b446690ef..088ddca7d 100644 --- a/.agents/skills/draft_reference/SKILL.md +++ b/.agents/skills/draft_reference/SKILL.md @@ -9,6 +9,8 @@ Draft a reference documentation page with structured, exhaustive information for ## Workflow +Read and apply `.agents/references/compliance-claims-policy.md` before drafting, including its omission and internal-reporting rules. + Follow the workflow in `.agents/skills/draft_docs/SKILL.md`, using the **reference template** at `.agents/templates/reference.md`. ## Frontmatter description diff --git a/.agents/skills/draft_troubleshooting/SKILL.md b/.agents/skills/draft_troubleshooting/SKILL.md index 39e245910..99a0a956c 100644 --- a/.agents/skills/draft_troubleshooting/SKILL.md +++ b/.agents/skills/draft_troubleshooting/SKILL.md @@ -9,6 +9,8 @@ Draft a troubleshooting page that helps users diagnose and fix common issues. ## Workflow +Read and apply `.agents/references/compliance-claims-policy.md` before drafting, including its omission and internal-reporting rules. + Follow the workflow in `.agents/skills/draft_docs/SKILL.md`, using the **troubleshooting template** at `.agents/templates/troubleshooting.md`. ## Frontmatter description diff --git a/.agents/skills/review-docs-pr/SKILL.md b/.agents/skills/review-docs-pr/SKILL.md index 93a34dd6f..bf8ab4377 100644 --- a/.agents/skills/review-docs-pr/SKILL.md +++ b/.agents/skills/review-docs-pr/SKILL.md @@ -72,6 +72,8 @@ review focus areas, this pass is the human-review-blocking gate defined in ## Review Instructions +Read and apply `.agents/references/compliance-claims-policy.md`. Flag customer-facing HIPAA references, implications of HIPAA-regulated-workload or HIPAA business associate agreement support, and other compliance promises without current Security or Legal approval as critical accuracy findings and request changes. Existing docs, source code, general approvals, and public `VERIFY` markers do not satisfy that policy. + Review this documentation PR for the docs repository. Focus on: diff --git a/AGENTS.md b/AGENTS.md index d82b206d2..5f0f31644 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -6,6 +6,10 @@ This guide establishes standards for writing Warp documentation. It covers voice, formatting, content types, and terminology. Keep the full writing rules here. Skills and templates must state the actions needed for their tasks and link here for additional detail. Document product behavior in the relevant product documentation, not in general writing rules. +## Compliance claims + +Before writing, reviewing, or answering from docs, apply [the compliance claims policy](.agents/references/compliance-claims-policy.md). Warp is not HIPAA compliant; omit HIPAA from customer-facing content and never imply support for HIPAA-regulated workloads or a HIPAA business associate agreement. Other compliance claims require a current Warp Security or Legal-approved source for the exact claim and scope. Omit unsupported claims and flag them in the internal handoff or PR evidence. + ## Writing style ### Voice & tone diff --git a/src/content/docs/agents/getting-started/faqs.mdx b/src/content/docs/agents/getting-started/faqs.mdx index 63d1c1d31..0ea7ce63a 100644 --- a/src/content/docs/agents/getting-started/faqs.mdx +++ b/src/content/docs/agents/getting-started/faqs.mdx @@ -21,7 +21,7 @@ Agent Mode has replaced the previous AI chat panel. Agent Mode is more powerful ### Is my data used for model training? -Warp reserves the right to use data collected to train models and improve Warp. Warp has Zero Data Retention with all its model providers (e.g. Anthropic, OpenAI, xAI, etc.). Learn more about telemetry on our [Privacy page](/support-and-community/privacy-and-security/privacy/). +Review the [Privacy page](/support-and-community/privacy-and-security/privacy/) for data collection and telemetry controls, and the [privacy policy](https://www.warp.dev/legal/privacy-policy) for the applicable terms. ### What model are you using for Agent Mode? diff --git a/src/content/docs/agents/index.mdx b/src/content/docs/agents/index.mdx index f1b10abe2..f6d82a7a5 100644 --- a/src/content/docs/agents/index.mdx +++ b/src/content/docs/agents/index.mdx @@ -62,7 +62,7 @@ The {VARS.WARP_AUTOMATION_PLATFORM} tab covers the platform in full. ## Privacy and security -Warp is **SOC 2 compliant** and has **Zero Data Retention** policies with all contracted LLM providers. No customer AI data is retained, stored, or used for training. +Review [security and data handling](/enterprise/security-and-compliance/security-overview/) when evaluating agent workflows for your team. You can disable Warp's AI features entirely in **Settings** > **Agents** > **Warp Agent**. diff --git a/src/content/docs/agents/inference/bring-your-own-api-key.mdx b/src/content/docs/agents/inference/bring-your-own-api-key.mdx index d49011bf5..4a4591daa 100644 --- a/src/content/docs/agents/inference/bring-your-own-api-key.mdx +++ b/src/content/docs/agents/inference/bring-your-own-api-key.mdx @@ -105,11 +105,9 @@ You can update or replace your keys anytime by opening **Settings** and searchin ### Zero Data Retention (ZDR) and BYOK -Warp is **SOC 2 compliant** and has **Zero Data Retention (ZDR)** policies with all of its contracted LLM providers. No customer AI data is retained, stored, or used for training by the model providers. +BYOK prompts and responses transit Warp's backend (see [How BYOK works](#how-byok-works)). -BYOK prompts and responses transit Warp's backend (see [How BYOK works](#how-byok-works)). Warp does not use this content for training; retention and analytics handling follow the same account-level privacy and telemetry settings that apply to Warp-billed traffic. - -However, when you use your own API key: +When you use your own API key: * Data retention policies on the **provider side** depend on your provider’s account settings. * Warp cannot enforce ZDR for requests sent through your API keys. diff --git a/src/content/docs/agents/inference/custom-inference-endpoint.mdx b/src/content/docs/agents/inference/custom-inference-endpoint.mdx index 768d9e2c2..9fa030e10 100644 --- a/src/content/docs/agents/inference/custom-inference-endpoint.mdx +++ b/src/content/docs/agents/inference/custom-inference-endpoint.mdx @@ -83,9 +83,7 @@ Other features use their own inference configuration and are unaffected by a per ## Zero Data Retention (ZDR) -Warp is **SOC 2 compliant** and has **Zero Data Retention (ZDR)** agreements with all of its contracted LLM providers. - -Custom inference endpoint prompts and responses transit Warp's backend (see [How it works](#how-it-works)). Warp does not use this content for training; retention and analytics handling follow the same account-level privacy and telemetry settings that apply to Warp-billed traffic. +Custom inference endpoint prompts and responses transit Warp's backend (see [How it works](#how-it-works)). When you use a custom inference endpoint: diff --git a/src/content/docs/agents/inference/grok-subscription.mdx b/src/content/docs/agents/inference/grok-subscription.mdx index 336ac5a0a..e955c58f6 100644 --- a/src/content/docs/agents/inference/grok-subscription.mdx +++ b/src/content/docs/agents/inference/grok-subscription.mdx @@ -63,7 +63,7 @@ A connected SuperGrok subscription does not apply to [cloud runs](/platform/). C ### Zero data retention (ZDR) -Warp has Zero Data Retention agreements with its contracted LLM providers, including xAI, for Warp-managed inference. When you connect your own subscription, data retention on xAI's side is governed by your own xAI account and its terms — Warp cannot enforce ZDR for requests sent through your subscription. Warp itself never stores your tokens on its servers. +When you connect your own subscription, data retention on xAI's side is governed by your own xAI account and its terms. Warp cannot enforce ZDR for requests sent through your subscription. ## Disconnecting diff --git a/src/content/docs/agents/inference/model-choice.mdx b/src/content/docs/agents/inference/model-choice.mdx index e5261cd93..d3405ff40 100644 --- a/src/content/docs/agents/inference/model-choice.mdx +++ b/src/content/docs/agents/inference/model-choice.mdx @@ -73,7 +73,7 @@ Suffixes select effort level. `xhigh-fast` enables fast mode, and `thinking` ena Claude Haiku 5.5 has no fixed default `model_id`; choose one of its effort-specific IDs. :::caution -Anthropic requires data retention for Claude Fable 5, Claude Fable 5.1, and Claude Fable 5.2 for safety, abuse monitoring, and compliance reasons, so these models are **not available under Zero Data Retention (ZDR)**. This requirement is specific to the Claude Fable models and doesn't change the ZDR behavior of any other supported model. For Enterprise teams, these models are off by default and a workspace admin must enable them — see the [Admin Panel](/enterprise/team-management/admin-panel/#models-settings) and the [Security overview](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr). +Claude Fable 5, Claude Fable 5.1, and Claude Fable 5.2 have provider-specific data retention requirements. For Enterprise teams, these models are off by default and a workspace admin must enable them. See the [Admin Panel](/enterprise/team-management/admin-panel/#models-settings). ::: #### Google @@ -155,23 +155,8 @@ You can configure the base model for each [Agent Profile](/agents/capabilities/a Edit your default profile or any other profile directly in **Settings** > **Agents** > **Profiles**. -### Zero data retention policies + -Warp integrates with multiple large language model (LLM) providers to power its AI-driven features. +### Data handling -**These providers include, but are not limited to:** - -* OpenAI -* Anthropic -* Google -* xAI -* Fireworks AI - -Warp has executed **Zero Data Retention (ZDR)** agreements with these providers. This means that, by default across all plans: - -* LLM providers commit not to train their models on any customer-generated data processed through Warp’s services. -* LLM providers commit to delete inputs and outputs after generating the relevant output, within a fixed time period. - -Warp enforces these commitments through both technical measures and contractual safeguards with the LLM providers. - -Zero data retention is available for supported models. Model availability may vary where providers require data retention for safety, abuse monitoring, or compliance reasons. +Review the [Security overview](/enterprise/security-and-compliance/security-overview/) for data flows and controls. Contact [security@warp.dev](mailto:security@warp.dev) to confirm retention terms for the model and inference configuration you plan to use. diff --git a/src/content/docs/enterprise/enterprise-features/architecture-and-deployment.mdx b/src/content/docs/enterprise/enterprise-features/architecture-and-deployment.mdx index 9fb4e1224..1e3c44fd6 100644 --- a/src/content/docs/enterprise/enterprise-features/architecture-and-deployment.mdx +++ b/src/content/docs/enterprise/enterprise-features/architecture-and-deployment.mdx @@ -27,7 +27,6 @@ The [stack overview](/platform/architecture/#stack-overview) reference describes * **Warp terminal (client)** ↔ **Warp backend (control plane)** ↔ **LLM providers** * The Warp backend handles task orchestration, observability, and LLM inference routing. -* LLM providers operate under **Zero Data Retention (ZDR)** agreements. They do not store or train on your data. * The **execution plane** is where source code is accessed, commands run, and build artifacts are produced. This can run on Warp's infrastructure or yours. ## Warp-hosted (SaaS) @@ -53,11 +52,10 @@ Warp-hosted agents can be triggered by: * You want the simplest path to scalable cloud agent execution. * You need to run many tasks in parallel without building sandboxing infrastructure. -* Your security requirements are met by Warp's SOC 2 Type II certified infrastructure with ZDR. ## Self-hosted execution -For organizations that need agent execution and source code to remain within their own network boundary, Warp supports self-hosted execution. +Warp supports running agent tools on your infrastructure. Inference and session data still transit Warp's servers. :::note Self-hosted execution is available exclusively on Warp's **Enterprise** plan. @@ -67,8 +65,8 @@ Self-hosted execution is available exclusively on Warp's **Enterprise** plan. Self-hosted deployments use a split architecture: -* **Execution plane (customer-hosted)** - Source code repositories, build artifacts, shell commands, and runtime secrets stay on your infrastructure. Note that during agent interactions, code context is included in LLM prompts and session transcripts that route through Warp's servers under ZDR agreements (see [What transits Warp's servers](#what-transits-warps-servers)). -* **Control plane (Warp-hosted)** - Task orchestration, observability data, and LLM inference route through Warp's servers under Zero Data Retention (ZDR) agreements. +* **Execution plane (customer-hosted)** - Repository clones, build artifacts, and agent tools run on your infrastructure. Code context, commands, and output can be included in LLM prompts and session transcripts that route through Warp's servers (see [What transits Warp's servers](#what-transits-warps-servers)). +* **Control plane (Warp-hosted)** - Task orchestration, observability data, and LLM inference route through Warp's servers. ### Deployment modes @@ -95,9 +93,8 @@ Self-hosted agents require **outbound-only** network access. No inbound network ### When to use -* Compliance or security requirements prevent using Warp-hosted compute. -* Source code and execution must stay within your network boundary. -* You want {VARS.WARP_AUTOMATION_PLATFORM} orchestration and visibility without sending code to Warp's infrastructure. +* You need agent tools to run in your own execution environment. +* You want the {VARS.WARP_AUTOMATION_PLATFORM}'s orchestration and visibility with customer-hosted compute. ## Hybrid deployments @@ -105,7 +102,7 @@ Organizations can combine Warp-hosted and self-hosted execution to balance conve ### How it works -* Route sensitive workloads (e.g., production code, regulated data) to self-hosted agents. +* Route tasks that need your execution environment to self-hosted agents. * Route less sensitive workloads (e.g., open-source tooling, internal utilities) to Warp-hosted agents. * Both execution modes share the same {VARS.DASHBOARD}, session sharing, and API/SDK visibility. @@ -123,15 +120,15 @@ Understanding what data stays where is critical for security and compliance deci * **Source code** - Repository contents and version history * **Build artifacts** - Compiled outputs and generated files -* **Shell commands** - Terminal commands and their output * **Runtime secrets** - Environment variables and credentials -* **Execution logs** - Agent run logs and diagnostics + +Agent prompts, transcripts, and output can contain code or other data from that environment and transit Warp's servers. ### What transits Warp's servers * **Task orchestration** - Scheduling, routing, and lifecycle management * **Observability data** - Run status, duration, and metadata -* **LLM inference** - Prompts and responses (which include code context from agent interactions) routed through Warp to contracted LLM providers under ZDR agreements +* **LLM inference** - Prompts and responses (which include code context from agent interactions) routed through Warp to LLM providers * **Session sharing data** - Session transcripts, which include code context from agent interactions, when session sharing is enabled for monitoring and collaboration ## Choosing a deployment model @@ -142,11 +139,9 @@ Consider the following when selecting a deployment model: **Warp-hosted** is right if: * You want zero infrastructure management for agent execution. -* Your security team is comfortable with SOC 2 Type II certified, ZDR-covered infrastructure. * You need maximum parallelization and scalability. **Self-hosted** is right if: -* Compliance requirements mandate that code stays within your network. * You need to integrate with existing CI/CD or infrastructure tooling. * You want full control over the execution environment. diff --git a/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx b/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx index 6528ea7a9..64ef8566a 100644 --- a/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx +++ b/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx @@ -302,13 +302,10 @@ Rates follow your [Enterprise contract](/enterprise/support-and-resources/billin * **No long-lived API keys** — BYOLLM uses cloud-native IAM with short-lived session tokens. * **Per-user authentication** — Each team member authenticates individually; credentials are not shared. -* **No storage or logging** — Warp never stores or logs your cloud session tokens on its servers. ### Zero Data Retention (ZDR) -Warp maintains **SOC 2 compliance** and has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers. - -However, when using BYOLLM: +When using BYOLLM: * **Your** cloud account settings determine data retention policies. * Warp cannot enforce ZDR for requests routed through your infrastructure. @@ -355,13 +352,6 @@ Business and Enterprise admins can also centrally manage BYOK itself: [team-mana | Billing | Direct to provider | Your cloud account | | Data locality | Provider infrastructure | Your cloud infrastructure | -### What data does Warp store? Do you store our cloud credentials? - -Warp **does not store or log** your cloud credentials. - -* **Interactive terminal use** — Credentials are used transiently to sign requests and are never persisted on Warp servers. -* **Cloud agent runs** — Temporary AWS credentials are used only for the duration of the run and are not retained after it ends. - ### Can admins enforce provider-only routing and disable Warp-managed models? Yes. Admins can configure routing policies to require specific models to use BYOLLM and disable direct API access to Warp-managed model endpoints. diff --git a/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx b/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx index f0143cf58..7deb57be5 100644 --- a/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx +++ b/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx @@ -353,15 +353,13 @@ Rates and credit pools follow your [Enterprise contract](/enterprise/support-and ### Credential security -* **No long-lived credentials** - The only long-lived credential involved is the member's Warp session. Access tokens are short-lived, held in memory, and never persisted. -* **Nothing sensitive leaves your boundary** - Warp stores only non-secret routing configuration (project ID, location, WIF audience, and optional service account email). Service account keys, refresh tokens, and credential files are never uploaded to Warp. +* **Short-lived access tokens** - Gemini Enterprise uses federated access tokens minted from the member's Warp session. +* **Routing configuration** - Admins configure the project ID, location, WIF audience, and optional service account email. Inference requests still route through Warp's servers. * **Per-user identity** - Every token is minted for the individual signed-in member, so access control and revocation stay in your identity stack: remove a member from your Warp team (or restrict the WIF provider's attribute condition) and their tokens stop minting. ### Zero Data Retention (ZDR) -Warp maintains **SOC 2 compliance** and has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers. - -However, when using Gemini Enterprise: +When using Gemini Enterprise: * **Your** Google Cloud project settings determine data retention policies. * Warp cannot enforce ZDR for requests routed through your infrastructure. diff --git a/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx b/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx index b2eb89570..cba5612d7 100644 --- a/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx +++ b/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx @@ -108,7 +108,7 @@ Warp uses the stored credentials to call your provider without delivering them t ### Zero Data Retention (ZDR) -Warp is **SOC 2 compliant** and has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers. When you route through your own keys or endpoints: +When you route through your own keys or endpoints: * Data retention on the **provider side** is determined by your provider's account settings. * Warp **cannot enforce ZDR** for requests sent through your keys or endpoints. diff --git a/src/content/docs/enterprise/index.mdx b/src/content/docs/enterprise/index.mdx index 72f428ed5..fa1389ca7 100644 --- a/src/content/docs/enterprise/index.mdx +++ b/src/content/docs/enterprise/index.mdx @@ -6,7 +6,7 @@ description: >- --- import { VARS } from '@data/vars'; -Warp Enterprise is built for organizations that want to accelerate software development with agents while maintaining security, compliance, and administrative control. It brings Warp's **Agentic Development Environment** to your entire engineering organization with the governance features IT and security teams require. +Warp Enterprise provides agent workflows and administrative controls for engineering organizations. It brings Warp's **Agentic Development Environment** to your team with centralized settings and collaboration features. Warp has three products: @@ -31,8 +31,6 @@ Warp Enterprise serves three primary audiences: * **Usage visibility** - Monitor team adoption and agent usage across your organization, and pull usage data programmatically with the [Analytics API](/enterprise/enterprise-features/analytics-api/) ### Security and compliance -* **SOC 2 Type II certified** - Meets enterprise security and compliance requirements -* **Zero Data Retention (ZDR)** - No customer data is retained, stored, or used for training by contracted LLM providers * **Open source client** - Warp's client code is published under [AGPL v3](https://github.com/warpdotdev/warp/blob/master/LICENSE-AGPL) at [`warpdotdev/warp`](https://github.com/warpdotdev/warp) for security review and audit * **Bring Your Own LLM (BYOLLM)** - Route inference through your own cloud infrastructure (AWS Bedrock or Google Cloud via Gemini Enterprise) * **Team-managed API keys and endpoints** - Share provider API keys and custom endpoints across your Business or Enterprise team for both interactive sessions and cloud agents diff --git a/src/content/docs/enterprise/security-and-compliance/security-overview.mdx b/src/content/docs/enterprise/security-and-compliance/security-overview.mdx index e0518bb26..92a623e18 100644 --- a/src/content/docs/enterprise/security-and-compliance/security-overview.mdx +++ b/src/content/docs/enterprise/security-and-compliance/security-overview.mdx @@ -1,13 +1,12 @@ --- title: Security overview description: >- - Understand Warp's security architecture, data handling practices, and - compliance certifications to ensure your organization's requirements are - met. + Review Warp's data flows, telemetry settings, authentication, and + deployment boundaries when evaluating security controls for your team. --- import { VARS } from '@data/vars'; -Warp builds security and compliance into its core, keeping **developers in control** while enabling powerful agent workflows. This overview explains how Warp handles your data, what security controls are available, and how Warp meets enterprise security standards. +Warp provides controls for telemetry, authentication, and agent permissions. Review the data flows and deployment boundaries below when evaluating Warp for your organization. ## Transparency and control @@ -21,9 +20,9 @@ Warp's security philosophy centers on **transparency and developer control**: ## What telemetry does Warp collect and why? -### Zero Data Retention (ZDR) + -Warp has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers (Anthropic, OpenAI, Google, xAI), meaning they do not store or train on your data. ZDR applies across all Warp plans. +### Data collection controls How data collection works by plan: @@ -35,7 +34,7 @@ How data collection works by plan: Some product features — including cloud conversations and {VARS.PLATFORM_RUN}s — require storing conversation data to function. This data is stored to power the product experience and is separate from analytics or telemetry data collection. ::: -Some models carry provider-specific data retention requirements and are therefore not covered by ZDR. For Enterprise teams, these models are **off by default**; a workspace admin must explicitly enable them in the [Admin Panel](/enterprise/team-management/admin-panel/#models-settings). +Some models have provider-specific data retention requirements. For Enterprise teams, these models are **off by default**; a workspace admin must explicitly enable them in the [Admin Panel](/enterprise/team-management/admin-panel/#models-settings). Enterprise subscriptions also include: @@ -71,10 +70,10 @@ Team admins can enforce telemetry settings organization-wide through the Admin P * **Code and files** - Stay on your machine unless you explicitly use features that transmit them (e.g., Codebase Context indexing, session sharing, Warp Drive team resources) * **Codebase Context** - During indexing, code is sent to Warp's servers to generate embeddings; the raw code is not stored, only the resulting embeddings are retained -* **Agent requests** - Warp sends requests to contracted LLM providers (Anthropic, OpenAI, Google, xAI) with Zero Data Retention agreements for Enterprise teams -* **BYOLLM** - Requests are proxied through Warp's servers to your cloud infrastructure, where inference runs. Warp does not store the content of these requests. +* **Agent requests** - Warp sends inference requests to LLM providers +* **BYOLLM** - Requests are proxied through Warp's servers to your cloud infrastructure, where inference runs * **Team-managed API keys and endpoints** - When an admin configures [team-managed API keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/), the keys are encrypted and stored server-side, never synced to member devices, and never delivered to cloud agent environments. They're decrypted only in memory when serving a request. -* **Self-hosted cloud agent execution** - Repository clones, build artifacts, runtime secrets, and execution workspaces stay on your infrastructure. Orchestration metadata, session transcripts, and LLM inference requests and responses route through Warp under ZDR, and can include code context from agent interactions. +* **Self-hosted cloud agent execution** - Repository clones, build artifacts, runtime secrets, and execution workspaces stay on your infrastructure. Orchestration metadata, session transcripts, and LLM inference requests and responses route through Warp and can include code context from agent interactions. ### Encryption @@ -96,22 +95,12 @@ See [Secret Redaction documentation](/support-and-community/privacy-and-security ### Data retention -* **ZDR** - Warp's contracted LLM providers do not retain or train on your data * **Telemetry data** - When collected, Warp retains telemetry data indefinitely for analytics and debugging * **User accounts** - Data deletion requests are processed securely within 30 days at no cost, following verified authentication and compliance with legal and contractual obligations -## Compliance and certifications +## Security assessment materials -### SOC 2 Type II - -Warp is SOC 2 Type II certified, demonstrating compliance with industry-standard security controls for: - -* **Security** - Infrastructure protection, access controls, and monitoring -* **Availability** - System uptime and disaster recovery -* **Confidentiality** - Data protection and privacy controls -* **Processing integrity** - Accurate, complete, and authorized processing - -SOC 2 reports are available to Enterprise customers upon request. +Contact [security@warp.dev](mailto:security@warp.dev) for current assessment materials and their scope. See the [Trust Center](/enterprise/security-and-compliance/trust-center/). ## Infrastructure security @@ -119,18 +108,16 @@ SOC 2 reports are available to Enterprise customers upon request. When using Warp's hosted infrastructure: -* **Cloud provider** - Hosted on GCP with SOC 2 and ISO 27001 certified datacenters +* **Cloud provider** - Hosted on GCP * **Network isolation** - Workloads run in isolated VPCs with strict network policies -Warp's operational security practices — including access controls, monitoring, and vulnerability management — are validated through SOC 2 Type II certification. See [Compliance and certifications](#compliance-and-certifications) for details. - ### Self-hosted deployments Enterprise teams can self-host cloud agent execution to control where agents run and keep repositories on their own infrastructure. Self-hosted deployments use a split architecture: * **Execution plane (customer-hosted)** - Repository clones, build artifacts, runtime secrets, and container filesystem state stay on your infrastructure -* **Control plane (Warp-hosted)** - Session transcripts (which include code context from agent interactions), orchestration metadata, and LLM inference route through Warp's servers under Zero Data Retention (ZDR) agreements. Warp does not persistently store your source code or use it for model training +* **Control plane (Warp-hosted)** - Session transcripts (which include code context from agent interactions), orchestration metadata, and LLM inference route through Warp's servers Two deployment modes are available: * **Unmanaged** - Use `oz agent run` to run agents in your existing orchestrator or CI environment. Supports Linux, macOS, and Windows with no Docker dependency. @@ -171,11 +158,10 @@ Security-relevant controls include: ### Bring Your Own LLM (BYOLLM) -Route agent inference through your own cloud infrastructure for complete control: +Route agent inference through your own cloud provider account: * **Data locality** - Interactive agent inference runs in your AWS account or Google Cloud project * **Cloud-native IAM** - Authenticate using your user's existing identity and access management process -* **No key storage** - Warp never stores your cloud credentials or API keys * **Billing control** - Inference costs billed directly to your cloud account See [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) for configuration details. @@ -222,11 +208,11 @@ Enterprise customers receive priority security support: ## Additional resources * [Warp privacy policy](https://www.warp.dev/legal/privacy-policy) -* [Warp Trust Center](https://trust.warp.dev) — security documentation and compliance reports. See also [Trust Center](/enterprise/security-and-compliance/trust-center/) for details on requesting SOC 2 reports, subprocessors, and vendor security assessments. +* [Warp Trust Center](https://trust.warp.dev) - Security documentation. See also [Trust Center](/enterprise/security-and-compliance/trust-center/) for vendor security review contacts. * [Warp subprocessors list](https://www.warp.dev/legal/subprocessors) * **Privacy documentation** - [Privacy guide](/support-and-community/privacy-and-security/privacy/) with complete telemetry table * **Contact** - [privacy@warp.dev](mailto:privacy@warp.dev) for privacy questions, [security@warp.dev](mailto:security@warp.dev) for security issues :::note -For vendor security assessments, compliance questionnaires, or access to SOC 2 reports, contact your account manager or email [security@warp.dev](mailto:security@warp.dev). +For vendor security assessments or compliance questionnaires, contact your account manager or email [security@warp.dev](mailto:security@warp.dev). ::: diff --git a/src/content/docs/enterprise/security-and-compliance/trust-center.mdx b/src/content/docs/enterprise/security-and-compliance/trust-center.mdx index c4aefffd5..c2e401423 100644 --- a/src/content/docs/enterprise/security-and-compliance/trust-center.mdx +++ b/src/content/docs/enterprise/security-and-compliance/trust-center.mdx @@ -3,24 +3,15 @@ title: Warp Trust Center sidebar: label: "Trust Center" description: >- - Access Warp's security documentation, compliance certifications, and - third-party assessment resources to complete your vendor security review. + Find Warp's security documentation and contact the security team for + materials to evaluate Warp during your vendor security review. --- -Warp's [Trust Center](https://trust.warp.dev) is the central hub for security documentation, compliance certifications, and third-party assessments. It provides the information security teams, procurement, and compliance officers need to evaluate Warp as a vendor and complete security reviews. +Use Warp's [Trust Center](https://trust.warp.dev) to find security documentation for your vendor review. -## Compliance certifications +## Requesting assessment materials -### SOC 2 Type II - -Warp is **SOC 2 Type II certified**, demonstrating compliance with industry-standard security controls across the following trust service criteria: - -* **Security** - Infrastructure protection, access controls, and monitoring -* **Availability** - System uptime and disaster recovery -* **Confidentiality** - Data protection and privacy controls -* **Processing integrity** - Accurate, complete, and authorized processing - -**Requesting SOC 2 reports:** Enterprise customers can request SOC 2 reports directly through the [Trust Center portal](https://trust.warp.dev), through their account manager, or by emailing [security@warp.dev](mailto:security@warp.dev). +Contact [security@warp.dev](mailto:security@warp.dev) for current assessment materials and their scope. ## Subprocessors @@ -28,16 +19,12 @@ Warp publishes a list of subprocessors — third-party service providers that pr View the current list of subprocessors at [Warp subprocessors list](https://www.warp.dev/legal/subprocessors). -:::note -Warp maintains **Zero Data Retention (ZDR)** agreements with its contracted LLM providers (Anthropic, OpenAI, Google, xAI), meaning they do not store or train on your data. -::: - ## Security documentation The following resources provide detailed information about Warp's security practices: -* **[Trust Center portal](https://trust.warp.dev)** - External portal with downloadable compliance reports and real-time security status -* **[Security overview](/enterprise/security-and-compliance/security-overview/)** - Warp's security architecture, data handling, and compliance certifications +* **[Trust Center portal](https://trust.warp.dev)** - Security documentation for vendor reviews +* **[Security overview](/enterprise/security-and-compliance/security-overview/)** - Warp's security architecture and data handling * **[Privacy policy](https://www.warp.dev/legal/privacy-policy)** - How Warp collects, uses, and protects personal data * **[Subprocessors](https://www.warp.dev/legal/subprocessors)** - Third-party service providers that process data on Warp's behalf @@ -45,17 +32,12 @@ The following resources provide detailed information about Warp's security pract If you're conducting a vendor security assessment or completing a compliance questionnaire, Warp can provide: -* **SOC 2 Type II reports** - Available upon request for Enterprise customers * **Compliance questionnaire assistance** - Warp's security team can help complete vendor security questionnaires * **[Architecture and deployment](/enterprise/enterprise-features/architecture-and-deployment/)** - Details about Warp's infrastructure, deployment models, and data flows To request any of these materials, contact your account manager or email [security@warp.dev](mailto:security@warp.dev). -## Penetration testing and vulnerability management - -Warp conducts regular security assessments as part of its SOC 2 program. The details of Warp's vulnerability management and penetration testing practices are validated through its SOC 2 Type II certification. - -### Responsible disclosure +## Responsible disclosure If you discover a security vulnerability in Warp, please report it responsibly: diff --git a/src/content/docs/enterprise/team-management/admin-panel.mdx b/src/content/docs/enterprise/team-management/admin-panel.mdx index 47ba35307..489ca1b30 100644 --- a/src/content/docs/enterprise/team-management/admin-panel.mdx +++ b/src/content/docs/enterprise/team-management/admin-panel.mdx @@ -19,7 +19,6 @@ The [Admin Panel](https://app.warp.dev/admin/) is your control center for managi * **Enforce security policies** - Configure secret redaction, telemetry controls, and data handling * **Manage team resources** - Enable Codebase Context, configure BYOLLM, and control sharing permissions * **Monitor usage** - Track consumption and configure spending controls -* **Maintain compliance** - Apply consistent policies that meet your organization's security requirements :::note Warp restricts Admin Panel access to team administrators. Regular team members can view settings that affect them but cannot modify organization-wide policies. @@ -106,7 +105,6 @@ The features available in the Admin Panel scale with your Warp plan: * **Enterprise secret redaction** - Custom regex patterns for secrets * **BYOLLM** - Route inference through your cloud infrastructure * **Self-hosting cloud agent workers** - Deploy cloud agent workers on your own infrastructure -* **Advanced compliance** - SOC 2, HIPAA, and custom data handling agreements * **Priority support** - Dedicated Slack/Teams channels For complete plan details, see [Warp pricing](https://www.warp.dev/pricing) or [contact sales](https://www.warp.dev/contact-sales). @@ -129,7 +127,6 @@ Configure how agents behave across your organization, including autonomy levels **Prompt summarization caching** * When conversations become long, the LLM provider caches summaries temporarily * Improves performance for extended agent interactions -* Zero Data Retention agreements cover caching (short-lived) #### Autonomy settings @@ -180,16 +177,14 @@ Command denylist rules take precedence over allowlist rules and agent autonomy s ### Privacy settings -Manage data collection and security policies to meet your organization's compliance requirements. +Manage data collection and security settings for your organization. **User-generated content (UGC) data collection** Controls how Warp collects and uses user-generated content to improve the service: -* **Disabled** - Warp collects no UGC data from your organization +* **Disabled** - Disable UGC collection for service improvement * **Enabled** - Allow data collection for service improvement * **Respect User Setting** - Let individual users decide -Enterprise teams with Zero Data Retention agreements can disable this completely. - **Enterprise secret redaction** Automatically detects and redacts sensitive information before sending data to LLM providers: * Enterprise plans enable this by default @@ -224,7 +219,7 @@ From the **Models** page, admins can also create team-synced [custom routers](/a **Models with provider-specific data retention requirements** -Some models require data retention from the model provider and are therefore not available under [Zero Data Retention (ZDR)](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr). For Enterprise teams, these models are **disabled by default**. A workspace admin must explicitly enable them before team members can use them. +Some models have provider-specific data retention requirements. For Enterprise teams, these models are **disabled by default**. A workspace admin must explicitly enable them before team members can use them. ### Billing settings diff --git a/src/content/docs/factories/self-hosting/security-and-networking.mdx b/src/content/docs/factories/self-hosting/security-and-networking.mdx index 343c8e1c6..49b5e6249 100644 --- a/src/content/docs/factories/self-hosting/security-and-networking.mdx +++ b/src/content/docs/factories/self-hosting/security-and-networking.mdx @@ -117,7 +117,7 @@ See [GitLab](/platform/integrations/gitlab/) and [Bitbucket](/platform/integrati ## LLM inference and BYOLLM -The Warp Agent sends inference requests through Warp. With Warp-managed inference, requests go to contracted providers covered by [ZDR](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr) agreements. With customer-supplied inference, provider-side retention follows your team's agreement with that provider. +The Warp Agent sends inference requests through Warp to LLM providers. With customer-supplied inference, provider-side retention follows your team's agreement with that provider. Teams that want inference routed and billed through their own accounts can use [team-managed model keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) or [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/). Plan requirements and cloud agent support vary by option; see [inference options for factory runs](/factories/infrastructure-and-security/#inference-options-for-factory-runs). @@ -131,6 +131,6 @@ Claude Code and Codex send inference requests directly to their providers under * [Unmanaged execution](/platform/unmanaged-execution/) - Run standalone agents from your own CI or scheduler * [About factory infrastructure and security](/factories/infrastructure-and-security/) - Choose execution, inference, and credential boundaries * [Data security and boundaries](/platform/architecture/#data-security-and-boundaries) - Review where each class of data lives and travels -* [Security overview](/enterprise/security-and-compliance/security-overview/) - Review Warp's security model and ZDR +* [Security overview](/enterprise/security-and-compliance/security-overview/) - Review Warp's security controls and data flows * [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) - Route inference through your own cloud provider accounts * [Self-hosted worker reference](/factories/self-hosting/reference/) - Look up worker flags and configuration diff --git a/src/content/docs/platform/architecture.mdx b/src/content/docs/platform/architecture.mdx index 3d05fd887..b02d244b4 100644 --- a/src/content/docs/platform/architecture.mdx +++ b/src/content/docs/platform/architecture.mdx @@ -34,7 +34,7 @@ Every cloud agent run follows the same lifecycle, no matter what started it or w 2. **The task is created** - The control plane opens a run record that tracks the task's state, inputs, and provenance. 3. **Configuration is resolved** - The platform picks the run's [environment](/factories/environments/), [runner](/factories/runners/), execution host, and [model and harness](/factories/harnesses/). 4. **The sandbox is provisioned** - The execution host clones the environment's repositories, runs setup commands, and injects only the [secrets](/platform/secrets/) the run is allowed to use. -5. **The agent loop runs** - The harness gathers context, calls the model, and runs tools until the task is done. Tools run in the sandbox. With the Warp Agent, model calls route through Warp to providers under [Zero Data Retention](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr); Claude Code and Codex call their provider directly. +5. **The agent loop runs** - The harness gathers context, calls the model, and runs tools until the task is done. Tools run in the sandbox. With the Warp Agent, model calls route through Warp to providers; Claude Code and Codex call their provider directly. 6. **Outputs land at their targets** - The agent pushes branches, opens pull requests, and replies to the Slack thread, Linear issue, or Jira work item that started the task. 7. **The run record persists** - Transcripts, artifacts, and cost data attach to the run record. 8. **The team has visibility** - Authorized users follow the run in the {VARS.DASHBOARD} or attach to it with [Agent Session Sharing](/agents/local-agents/session-sharing/). @@ -60,7 +60,7 @@ Self-hosted execution keeps checkout, commands, and the workspace on your infras 2. **Warp assigns the task** - When a trigger targets your worker, the control plane sends the task, its resolved configuration, and scoped runtime credentials over that connection. 3. **The agent runs on your backend** - The worker clones repositories, runs setup, injects allowed [secrets](/platform/secrets/), and executes in a Docker container, a Kubernetes Job, or directly on the host, depending on the [managed backend](/factories/self-hosting/#managed-architecture) you chose. Code, build artifacts, and workspaces stay on your machines. 4. **Run data returns to Warp** - Status, transcripts, artifacts, attachments, and telemetry flow back for the run record. Content the agent puts into prompts or results can include code context; see [execution security](/factories/self-hosting/security-and-networking/). -5. **Warp routes inference** - With the Warp Agent, model calls go from your worker through Warp to LLM providers under [Zero Data Retention](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr), or through your own provider account with [team-managed keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) or [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/). Claude Code and Codex call their provider directly from your infrastructure. +5. **Warp routes inference** - With the Warp Agent, model calls go from your worker through Warp to LLM providers, or through your own provider account with [team-managed keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) or [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/). Claude Code and Codex call their provider directly from your infrastructure. 6. **Your team monitors the run** - Runs on self-hosted workers appear in the {VARS.DASHBOARD} and support [Agent Session Sharing](/agents/local-agents/session-sharing/), the same as Warp-hosted runs. ### Self-hosted sequence view @@ -73,7 +73,7 @@ This sequence diagram shows the requests and responses exchanged among a trigger 2. **Assign task** - The control plane delivers the task over the worker's authenticated connection, with resolved configuration and scoped runtime credentials. 3. **Prepare workspace** - The worker clones repositories, runs setup commands, and injects allowed secrets. 4. **Prompt and context** - The agent gathers context inside the sandbox and sends it for inference. -5. **Inference** - Model calls from the Warp Agent route through Warp to LLM providers under ZDR, or through your own provider account with team-managed keys and endpoints or Bring Your Own LLM. +5. **Inference** - Model calls from the Warp Agent route through Warp to LLM providers, or through your own provider account with team-managed keys and endpoints or Bring Your Own LLM. 6. **Run tools** - Tool calls execute locally: files, commands, internal services, and MCP servers. 7. **Results** - Transcripts, tool outputs, and lifecycle updates return to the run record. 8. **Outputs** - The agent pushes a branch, opens a pull request, and replies to the integration that started the run. @@ -94,7 +94,7 @@ Every run moves a few distinct classes of data, and each class has its own bound ![Warp-hosted data security and boundaries diagram showing repositories, clients, and integrations in customer infrastructure, the per-run sandbox and control plane on the Warp platform, model providers, and Warp-managed run-data storage](../../../assets/agent-platform/warp-hosted-data-boundaries.png) * **Source code** - For Warp-hosted runs, repositories are cloned into an isolated per-run sandbox and destroyed with it; Warp does not persistently store repository clones or train on your code. For [managed self-hosting](/factories/self-hosting/), checkout and the workspace stay on your infrastructure. Either way, code context the agent puts into prompts, transcripts, or artifacts transits Warp and may persist as run data. -* **Prompts and context** - With the Warp Agent, model calls route through Warp to LLM providers under [Zero Data Retention](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr) agreements: providers don't retain or train on the traffic. [Team-managed keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) and [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) keep the same route but use your provider account. Claude Code and Codex call their provider directly from the execution environment, under your provider agreement rather than Warp's. +* **Prompts and context** - With the Warp Agent, model calls route through Warp to LLM providers. [Team-managed keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) and [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) keep the same route but use your provider account. Claude Code and Codex call their provider directly from the execution environment under your provider agreement. * **Run data** - Transcripts, artifacts, and run attachments are stored in Warp-managed storage, encrypted at rest and access-controlled by your team's roles. * **Control-plane data** - Warp always retains what it needs to operate the platform: user and organization settings, agent and factory configuration, orchestration and lifecycle metadata, trigger and integration metadata, operational logs, and usage and billing. * **Execution secrets** - Secrets you inject locally never transit Warp. [Managed secrets](/platform/secrets/) are stored encrypted and fetched just-in-time by the execution environment with a run-scoped token, and each delivery is audit-logged. Agents can also obtain short-lived cloud credentials at runtime through [workload identity federation](/platform/integrations/cloud-providers/) instead of holding long-lived secrets. [Secret redaction](/support-and-community/privacy-and-security/secret-redaction/) at output boundaries is a backstop, not a substitute for narrow scopes and rotation. diff --git a/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx b/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx index c2a43dab4..b1568bdfb 100644 --- a/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx +++ b/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx @@ -41,7 +41,7 @@ Warp offers two options for larger teams and organizations: If you’d like to explore Enterprise, [contact our sales team](https://www.warp.dev/contact-sales) and someone from Warp will follow up. ::: -For Warp-managed model traffic (requests Warp routes to OpenAI, Anthropic, Google, or xAI on your behalf), all plans are covered by Warp's Zero Data Retention (ZDR) agreements with the underlying model providers. Traffic you route through your own API key or a custom inference endpoint is governed by that provider's data-retention policies, not Warp's agreements. Admin-configurable data controls — including team-wide retention policies and training opt-outs — are available on Business and Enterprise. +Traffic you route through your own API key or a custom inference endpoint is subject to your provider's data-retention policies. Review [data collection controls](/enterprise/security-and-compliance/security-overview/#data-collection-controls) separately from provider retention terms. ### What counts as a team member and how does billing work for members? @@ -236,31 +236,23 @@ Warp Drive data is securely stored on Google Cloud Platform servers located in t For more details, [visit the Security Overview](https://www.warp.dev/legal/security) or contact [security@warp.dev](mailto:security@warp.dev). -### Does Warp have a SOC 2 Type 2 attestation? + -Yes. Warp has obtained a SOC 2 Type 2 attestation from an accredited third party. See the [Trust Center](/enterprise/security-and-compliance/trust-center/) to request the report. +### Where can I find security assessment materials? -### Does Warp have Zero Data Retention policies with LLM providers? +See the [Trust Center](/enterprise/security-and-compliance/trust-center/) and contact [security@warp.dev](mailto:security@warp.dev) for current assessment materials and their scope. -Warp integrates with multiple LLM providers — including Anthropic, OpenAI, Google, xAI, and Fireworks AI — to power its AI features. Warp has executed Zero Data Retention (ZDR) agreements with these providers. Across all plans, these agreements mean: + -* LLM providers commit not to train their models on any customer-generated data processed through Warp's services. -* LLM providers commit to delete inputs and outputs after generating the relevant output, within a fixed time period. +### Where can I confirm model-provider retention terms? -Warp enforces these commitments through both technical measures and contractual safeguards with the LLM providers. +Contact [security@warp.dev](mailto:security@warp.dev) to confirm the applicable terms for your model, provider, and inference configuration. -Zero data retention is available for supported models. Model availability may vary where providers require data retention for safety, abuse monitoring, or compliance reasons. + -### How can I enable Zero Data Retention in Warp? +### Does disabling telemetry change provider retention? -Zero Data Retention (ZDR) can be enabled in two ways: - -* **Individual level** — Any user can enable full ZDR for their own account by disabling **Help Improve Warp** in **Settings** > **Privacy**. -* **Organization-wide** — On Business and Enterprise plans, admins can enforce ZDR for all members from the [Admin Panel](/enterprise/team-management/admin-panel/), so team-wide compliance doesn't rely on individual settings. - -To discuss organization-wide ZDR for your team, [contact our sales team](https://www.warp.dev/contact-sales). - -Regardless of plan, Warp never allows OpenAI, Anthropic, Google, xAI, or other model providers to store, retain, or train their models on your data — see [Does Warp have Zero Data Retention policies with LLM providers?](#does-warp-have-zero-data-retention-policies-with-llm-providers) for details. +Telemetry controls and model-provider retention are separate. See [Privacy and data control](/support-and-community/privacy-and-security/privacy/) for telemetry settings; confirm provider terms separately before choosing an inference configuration. ### Can I bring my own API key? diff --git a/src/content/docs/support-and-community/privacy-and-security/privacy.mdx b/src/content/docs/support-and-community/privacy-and-security/privacy.mdx index 16c047343..35f8f5d88 100644 --- a/src/content/docs/support-and-community/privacy-and-security/privacy.mdx +++ b/src/content/docs/support-and-community/privacy-and-security/privacy.mdx @@ -33,10 +33,6 @@ If you haven't opted out of "Help improve Warp", we may collect: Telemetry must be enabled to use AI features on the Free plan, while paid plans can opt out at any time and continue using Warp, including AI. ::: -:::caution -Business and Enterprise plans are covered by our Zero Data Retention (ZDR) agreement. No AI interaction or console data is ever collected. -::: - Selling usage data will never be part of Warp's business model. This data is used solely to improve the end-user experience. Warp uses Sentry for crash reporting and Rudderstack for app analytics. You can read our [full privacy policy](https://www.warp.dev/legal/privacy-policy) as well as [how Warp handles security](https://www.warp.dev/legal/security). @@ -48,7 +44,7 @@ You can read our [full privacy policy](https://www.warp.dev/legal/privacy-policy ![Privacy Settings](../../../../assets/support-and-community/privacy-settings-after-signup-1.png) -With telemetry disabled, no console interactions are ever persisted on Warp's servers. Each request contains a `X-Warp-Telemetry-Enabled` header to specify whether telemetry is disabled, and even if this is missing from the request, our server assumes it's disabled. +Telemetry controls are separate from storage needed for product features such as [cloud conversations](/enterprise/security-and-compliance/security-overview/#data-collection-controls). Disabling telemetry does not establish model-provider retention terms. ### Delete your account and data From 9cccb63aceb8024a7a55256b9476f8259494557b Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Wed, 11 Nov 2026 20:04:18 +0000 Subject: [PATCH 2/2] docs: narrow public compliance correction to HIPAA only --- .../docs/agents/getting-started/faqs.mdx | 2 +- src/content/docs/agents/index.mdx | 2 +- .../inference/bring-your-own-api-key.mdx | 6 ++- .../inference/custom-inference-endpoint.mdx | 4 +- .../agents/inference/grok-subscription.mdx | 2 +- .../docs/agents/inference/model-choice.mdx | 23 ++++++++-- .../architecture-and-deployment.mdx | 23 ++++++---- .../byollm-aws-bedrock.mdx | 12 ++++- .../byollm-gemini-enterprise.mdx | 8 ++-- .../team-managed-keys-and-endpoints.mdx | 2 +- src/content/docs/enterprise/index.mdx | 4 +- .../security-overview.mdx | 46 ++++++++++++------- .../security-and-compliance/trust-center.mdx | 34 ++++++++++---- .../team-management/admin-panel.mdx | 11 +++-- .../self-hosting/security-and-networking.mdx | 4 +- src/content/docs/platform/architecture.mdx | 8 ++-- .../plans-and-billing/pricing-faqs.mdx | 28 +++++++---- .../privacy-and-security/privacy.mdx | 6 ++- 18 files changed, 156 insertions(+), 69 deletions(-) diff --git a/src/content/docs/agents/getting-started/faqs.mdx b/src/content/docs/agents/getting-started/faqs.mdx index 0ea7ce63a..63d1c1d31 100644 --- a/src/content/docs/agents/getting-started/faqs.mdx +++ b/src/content/docs/agents/getting-started/faqs.mdx @@ -21,7 +21,7 @@ Agent Mode has replaced the previous AI chat panel. Agent Mode is more powerful ### Is my data used for model training? -Review the [Privacy page](/support-and-community/privacy-and-security/privacy/) for data collection and telemetry controls, and the [privacy policy](https://www.warp.dev/legal/privacy-policy) for the applicable terms. +Warp reserves the right to use data collected to train models and improve Warp. Warp has Zero Data Retention with all its model providers (e.g. Anthropic, OpenAI, xAI, etc.). Learn more about telemetry on our [Privacy page](/support-and-community/privacy-and-security/privacy/). ### What model are you using for Agent Mode? diff --git a/src/content/docs/agents/index.mdx b/src/content/docs/agents/index.mdx index f6d82a7a5..f1b10abe2 100644 --- a/src/content/docs/agents/index.mdx +++ b/src/content/docs/agents/index.mdx @@ -62,7 +62,7 @@ The {VARS.WARP_AUTOMATION_PLATFORM} tab covers the platform in full. ## Privacy and security -Review [security and data handling](/enterprise/security-and-compliance/security-overview/) when evaluating agent workflows for your team. +Warp is **SOC 2 compliant** and has **Zero Data Retention** policies with all contracted LLM providers. No customer AI data is retained, stored, or used for training. You can disable Warp's AI features entirely in **Settings** > **Agents** > **Warp Agent**. diff --git a/src/content/docs/agents/inference/bring-your-own-api-key.mdx b/src/content/docs/agents/inference/bring-your-own-api-key.mdx index 4a4591daa..d49011bf5 100644 --- a/src/content/docs/agents/inference/bring-your-own-api-key.mdx +++ b/src/content/docs/agents/inference/bring-your-own-api-key.mdx @@ -105,9 +105,11 @@ You can update or replace your keys anytime by opening **Settings** and searchin ### Zero Data Retention (ZDR) and BYOK -BYOK prompts and responses transit Warp's backend (see [How BYOK works](#how-byok-works)). +Warp is **SOC 2 compliant** and has **Zero Data Retention (ZDR)** policies with all of its contracted LLM providers. No customer AI data is retained, stored, or used for training by the model providers. -When you use your own API key: +BYOK prompts and responses transit Warp's backend (see [How BYOK works](#how-byok-works)). Warp does not use this content for training; retention and analytics handling follow the same account-level privacy and telemetry settings that apply to Warp-billed traffic. + +However, when you use your own API key: * Data retention policies on the **provider side** depend on your provider’s account settings. * Warp cannot enforce ZDR for requests sent through your API keys. diff --git a/src/content/docs/agents/inference/custom-inference-endpoint.mdx b/src/content/docs/agents/inference/custom-inference-endpoint.mdx index 9fa030e10..768d9e2c2 100644 --- a/src/content/docs/agents/inference/custom-inference-endpoint.mdx +++ b/src/content/docs/agents/inference/custom-inference-endpoint.mdx @@ -83,7 +83,9 @@ Other features use their own inference configuration and are unaffected by a per ## Zero Data Retention (ZDR) -Custom inference endpoint prompts and responses transit Warp's backend (see [How it works](#how-it-works)). +Warp is **SOC 2 compliant** and has **Zero Data Retention (ZDR)** agreements with all of its contracted LLM providers. + +Custom inference endpoint prompts and responses transit Warp's backend (see [How it works](#how-it-works)). Warp does not use this content for training; retention and analytics handling follow the same account-level privacy and telemetry settings that apply to Warp-billed traffic. When you use a custom inference endpoint: diff --git a/src/content/docs/agents/inference/grok-subscription.mdx b/src/content/docs/agents/inference/grok-subscription.mdx index e955c58f6..336ac5a0a 100644 --- a/src/content/docs/agents/inference/grok-subscription.mdx +++ b/src/content/docs/agents/inference/grok-subscription.mdx @@ -63,7 +63,7 @@ A connected SuperGrok subscription does not apply to [cloud runs](/platform/). C ### Zero data retention (ZDR) -When you connect your own subscription, data retention on xAI's side is governed by your own xAI account and its terms. Warp cannot enforce ZDR for requests sent through your subscription. +Warp has Zero Data Retention agreements with its contracted LLM providers, including xAI, for Warp-managed inference. When you connect your own subscription, data retention on xAI's side is governed by your own xAI account and its terms — Warp cannot enforce ZDR for requests sent through your subscription. Warp itself never stores your tokens on its servers. ## Disconnecting diff --git a/src/content/docs/agents/inference/model-choice.mdx b/src/content/docs/agents/inference/model-choice.mdx index d3405ff40..e5261cd93 100644 --- a/src/content/docs/agents/inference/model-choice.mdx +++ b/src/content/docs/agents/inference/model-choice.mdx @@ -73,7 +73,7 @@ Suffixes select effort level. `xhigh-fast` enables fast mode, and `thinking` ena Claude Haiku 5.5 has no fixed default `model_id`; choose one of its effort-specific IDs. :::caution -Claude Fable 5, Claude Fable 5.1, and Claude Fable 5.2 have provider-specific data retention requirements. For Enterprise teams, these models are off by default and a workspace admin must enable them. See the [Admin Panel](/enterprise/team-management/admin-panel/#models-settings). +Anthropic requires data retention for Claude Fable 5, Claude Fable 5.1, and Claude Fable 5.2 for safety, abuse monitoring, and compliance reasons, so these models are **not available under Zero Data Retention (ZDR)**. This requirement is specific to the Claude Fable models and doesn't change the ZDR behavior of any other supported model. For Enterprise teams, these models are off by default and a workspace admin must enable them — see the [Admin Panel](/enterprise/team-management/admin-panel/#models-settings) and the [Security overview](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr). ::: #### Google @@ -155,8 +155,23 @@ You can configure the base model for each [Agent Profile](/agents/capabilities/a Edit your default profile or any other profile directly in **Settings** > **Agents** > **Profiles**. - +### Zero data retention policies -### Data handling +Warp integrates with multiple large language model (LLM) providers to power its AI-driven features. -Review the [Security overview](/enterprise/security-and-compliance/security-overview/) for data flows and controls. Contact [security@warp.dev](mailto:security@warp.dev) to confirm retention terms for the model and inference configuration you plan to use. +**These providers include, but are not limited to:** + +* OpenAI +* Anthropic +* Google +* xAI +* Fireworks AI + +Warp has executed **Zero Data Retention (ZDR)** agreements with these providers. This means that, by default across all plans: + +* LLM providers commit not to train their models on any customer-generated data processed through Warp’s services. +* LLM providers commit to delete inputs and outputs after generating the relevant output, within a fixed time period. + +Warp enforces these commitments through both technical measures and contractual safeguards with the LLM providers. + +Zero data retention is available for supported models. Model availability may vary where providers require data retention for safety, abuse monitoring, or compliance reasons. diff --git a/src/content/docs/enterprise/enterprise-features/architecture-and-deployment.mdx b/src/content/docs/enterprise/enterprise-features/architecture-and-deployment.mdx index 1e3c44fd6..9fb4e1224 100644 --- a/src/content/docs/enterprise/enterprise-features/architecture-and-deployment.mdx +++ b/src/content/docs/enterprise/enterprise-features/architecture-and-deployment.mdx @@ -27,6 +27,7 @@ The [stack overview](/platform/architecture/#stack-overview) reference describes * **Warp terminal (client)** ↔ **Warp backend (control plane)** ↔ **LLM providers** * The Warp backend handles task orchestration, observability, and LLM inference routing. +* LLM providers operate under **Zero Data Retention (ZDR)** agreements. They do not store or train on your data. * The **execution plane** is where source code is accessed, commands run, and build artifacts are produced. This can run on Warp's infrastructure or yours. ## Warp-hosted (SaaS) @@ -52,10 +53,11 @@ Warp-hosted agents can be triggered by: * You want the simplest path to scalable cloud agent execution. * You need to run many tasks in parallel without building sandboxing infrastructure. +* Your security requirements are met by Warp's SOC 2 Type II certified infrastructure with ZDR. ## Self-hosted execution -Warp supports running agent tools on your infrastructure. Inference and session data still transit Warp's servers. +For organizations that need agent execution and source code to remain within their own network boundary, Warp supports self-hosted execution. :::note Self-hosted execution is available exclusively on Warp's **Enterprise** plan. @@ -65,8 +67,8 @@ Self-hosted execution is available exclusively on Warp's **Enterprise** plan. Self-hosted deployments use a split architecture: -* **Execution plane (customer-hosted)** - Repository clones, build artifacts, and agent tools run on your infrastructure. Code context, commands, and output can be included in LLM prompts and session transcripts that route through Warp's servers (see [What transits Warp's servers](#what-transits-warps-servers)). -* **Control plane (Warp-hosted)** - Task orchestration, observability data, and LLM inference route through Warp's servers. +* **Execution plane (customer-hosted)** - Source code repositories, build artifacts, shell commands, and runtime secrets stay on your infrastructure. Note that during agent interactions, code context is included in LLM prompts and session transcripts that route through Warp's servers under ZDR agreements (see [What transits Warp's servers](#what-transits-warps-servers)). +* **Control plane (Warp-hosted)** - Task orchestration, observability data, and LLM inference route through Warp's servers under Zero Data Retention (ZDR) agreements. ### Deployment modes @@ -93,8 +95,9 @@ Self-hosted agents require **outbound-only** network access. No inbound network ### When to use -* You need agent tools to run in your own execution environment. -* You want the {VARS.WARP_AUTOMATION_PLATFORM}'s orchestration and visibility with customer-hosted compute. +* Compliance or security requirements prevent using Warp-hosted compute. +* Source code and execution must stay within your network boundary. +* You want {VARS.WARP_AUTOMATION_PLATFORM} orchestration and visibility without sending code to Warp's infrastructure. ## Hybrid deployments @@ -102,7 +105,7 @@ Organizations can combine Warp-hosted and self-hosted execution to balance conve ### How it works -* Route tasks that need your execution environment to self-hosted agents. +* Route sensitive workloads (e.g., production code, regulated data) to self-hosted agents. * Route less sensitive workloads (e.g., open-source tooling, internal utilities) to Warp-hosted agents. * Both execution modes share the same {VARS.DASHBOARD}, session sharing, and API/SDK visibility. @@ -120,15 +123,15 @@ Understanding what data stays where is critical for security and compliance deci * **Source code** - Repository contents and version history * **Build artifacts** - Compiled outputs and generated files +* **Shell commands** - Terminal commands and their output * **Runtime secrets** - Environment variables and credentials - -Agent prompts, transcripts, and output can contain code or other data from that environment and transit Warp's servers. +* **Execution logs** - Agent run logs and diagnostics ### What transits Warp's servers * **Task orchestration** - Scheduling, routing, and lifecycle management * **Observability data** - Run status, duration, and metadata -* **LLM inference** - Prompts and responses (which include code context from agent interactions) routed through Warp to LLM providers +* **LLM inference** - Prompts and responses (which include code context from agent interactions) routed through Warp to contracted LLM providers under ZDR agreements * **Session sharing data** - Session transcripts, which include code context from agent interactions, when session sharing is enabled for monitoring and collaboration ## Choosing a deployment model @@ -139,9 +142,11 @@ Consider the following when selecting a deployment model: **Warp-hosted** is right if: * You want zero infrastructure management for agent execution. +* Your security team is comfortable with SOC 2 Type II certified, ZDR-covered infrastructure. * You need maximum parallelization and scalability. **Self-hosted** is right if: +* Compliance requirements mandate that code stays within your network. * You need to integrate with existing CI/CD or infrastructure tooling. * You want full control over the execution environment. diff --git a/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx b/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx index 64ef8566a..6528ea7a9 100644 --- a/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx +++ b/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx @@ -302,10 +302,13 @@ Rates follow your [Enterprise contract](/enterprise/support-and-resources/billin * **No long-lived API keys** — BYOLLM uses cloud-native IAM with short-lived session tokens. * **Per-user authentication** — Each team member authenticates individually; credentials are not shared. +* **No storage or logging** — Warp never stores or logs your cloud session tokens on its servers. ### Zero Data Retention (ZDR) -When using BYOLLM: +Warp maintains **SOC 2 compliance** and has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers. + +However, when using BYOLLM: * **Your** cloud account settings determine data retention policies. * Warp cannot enforce ZDR for requests routed through your infrastructure. @@ -352,6 +355,13 @@ Business and Enterprise admins can also centrally manage BYOK itself: [team-mana | Billing | Direct to provider | Your cloud account | | Data locality | Provider infrastructure | Your cloud infrastructure | +### What data does Warp store? Do you store our cloud credentials? + +Warp **does not store or log** your cloud credentials. + +* **Interactive terminal use** — Credentials are used transiently to sign requests and are never persisted on Warp servers. +* **Cloud agent runs** — Temporary AWS credentials are used only for the duration of the run and are not retained after it ends. + ### Can admins enforce provider-only routing and disable Warp-managed models? Yes. Admins can configure routing policies to require specific models to use BYOLLM and disable direct API access to Warp-managed model endpoints. diff --git a/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx b/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx index 7deb57be5..f0143cf58 100644 --- a/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx +++ b/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx @@ -353,13 +353,15 @@ Rates and credit pools follow your [Enterprise contract](/enterprise/support-and ### Credential security -* **Short-lived access tokens** - Gemini Enterprise uses federated access tokens minted from the member's Warp session. -* **Routing configuration** - Admins configure the project ID, location, WIF audience, and optional service account email. Inference requests still route through Warp's servers. +* **No long-lived credentials** - The only long-lived credential involved is the member's Warp session. Access tokens are short-lived, held in memory, and never persisted. +* **Nothing sensitive leaves your boundary** - Warp stores only non-secret routing configuration (project ID, location, WIF audience, and optional service account email). Service account keys, refresh tokens, and credential files are never uploaded to Warp. * **Per-user identity** - Every token is minted for the individual signed-in member, so access control and revocation stay in your identity stack: remove a member from your Warp team (or restrict the WIF provider's attribute condition) and their tokens stop minting. ### Zero Data Retention (ZDR) -When using Gemini Enterprise: +Warp maintains **SOC 2 compliance** and has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers. + +However, when using Gemini Enterprise: * **Your** Google Cloud project settings determine data retention policies. * Warp cannot enforce ZDR for requests routed through your infrastructure. diff --git a/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx b/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx index cba5612d7..b2eb89570 100644 --- a/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx +++ b/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx @@ -108,7 +108,7 @@ Warp uses the stored credentials to call your provider without delivering them t ### Zero Data Retention (ZDR) -When you route through your own keys or endpoints: +Warp is **SOC 2 compliant** and has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers. When you route through your own keys or endpoints: * Data retention on the **provider side** is determined by your provider's account settings. * Warp **cannot enforce ZDR** for requests sent through your keys or endpoints. diff --git a/src/content/docs/enterprise/index.mdx b/src/content/docs/enterprise/index.mdx index fa1389ca7..72f428ed5 100644 --- a/src/content/docs/enterprise/index.mdx +++ b/src/content/docs/enterprise/index.mdx @@ -6,7 +6,7 @@ description: >- --- import { VARS } from '@data/vars'; -Warp Enterprise provides agent workflows and administrative controls for engineering organizations. It brings Warp's **Agentic Development Environment** to your team with centralized settings and collaboration features. +Warp Enterprise is built for organizations that want to accelerate software development with agents while maintaining security, compliance, and administrative control. It brings Warp's **Agentic Development Environment** to your entire engineering organization with the governance features IT and security teams require. Warp has three products: @@ -31,6 +31,8 @@ Warp Enterprise serves three primary audiences: * **Usage visibility** - Monitor team adoption and agent usage across your organization, and pull usage data programmatically with the [Analytics API](/enterprise/enterprise-features/analytics-api/) ### Security and compliance +* **SOC 2 Type II certified** - Meets enterprise security and compliance requirements +* **Zero Data Retention (ZDR)** - No customer data is retained, stored, or used for training by contracted LLM providers * **Open source client** - Warp's client code is published under [AGPL v3](https://github.com/warpdotdev/warp/blob/master/LICENSE-AGPL) at [`warpdotdev/warp`](https://github.com/warpdotdev/warp) for security review and audit * **Bring Your Own LLM (BYOLLM)** - Route inference through your own cloud infrastructure (AWS Bedrock or Google Cloud via Gemini Enterprise) * **Team-managed API keys and endpoints** - Share provider API keys and custom endpoints across your Business or Enterprise team for both interactive sessions and cloud agents diff --git a/src/content/docs/enterprise/security-and-compliance/security-overview.mdx b/src/content/docs/enterprise/security-and-compliance/security-overview.mdx index 92a623e18..e0518bb26 100644 --- a/src/content/docs/enterprise/security-and-compliance/security-overview.mdx +++ b/src/content/docs/enterprise/security-and-compliance/security-overview.mdx @@ -1,12 +1,13 @@ --- title: Security overview description: >- - Review Warp's data flows, telemetry settings, authentication, and - deployment boundaries when evaluating security controls for your team. + Understand Warp's security architecture, data handling practices, and + compliance certifications to ensure your organization's requirements are + met. --- import { VARS } from '@data/vars'; -Warp provides controls for telemetry, authentication, and agent permissions. Review the data flows and deployment boundaries below when evaluating Warp for your organization. +Warp builds security and compliance into its core, keeping **developers in control** while enabling powerful agent workflows. This overview explains how Warp handles your data, what security controls are available, and how Warp meets enterprise security standards. ## Transparency and control @@ -20,9 +21,9 @@ Warp's security philosophy centers on **transparency and developer control**: ## What telemetry does Warp collect and why? - +### Zero Data Retention (ZDR) -### Data collection controls +Warp has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers (Anthropic, OpenAI, Google, xAI), meaning they do not store or train on your data. ZDR applies across all Warp plans. How data collection works by plan: @@ -34,7 +35,7 @@ How data collection works by plan: Some product features — including cloud conversations and {VARS.PLATFORM_RUN}s — require storing conversation data to function. This data is stored to power the product experience and is separate from analytics or telemetry data collection. ::: -Some models have provider-specific data retention requirements. For Enterprise teams, these models are **off by default**; a workspace admin must explicitly enable them in the [Admin Panel](/enterprise/team-management/admin-panel/#models-settings). +Some models carry provider-specific data retention requirements and are therefore not covered by ZDR. For Enterprise teams, these models are **off by default**; a workspace admin must explicitly enable them in the [Admin Panel](/enterprise/team-management/admin-panel/#models-settings). Enterprise subscriptions also include: @@ -70,10 +71,10 @@ Team admins can enforce telemetry settings organization-wide through the Admin P * **Code and files** - Stay on your machine unless you explicitly use features that transmit them (e.g., Codebase Context indexing, session sharing, Warp Drive team resources) * **Codebase Context** - During indexing, code is sent to Warp's servers to generate embeddings; the raw code is not stored, only the resulting embeddings are retained -* **Agent requests** - Warp sends inference requests to LLM providers -* **BYOLLM** - Requests are proxied through Warp's servers to your cloud infrastructure, where inference runs +* **Agent requests** - Warp sends requests to contracted LLM providers (Anthropic, OpenAI, Google, xAI) with Zero Data Retention agreements for Enterprise teams +* **BYOLLM** - Requests are proxied through Warp's servers to your cloud infrastructure, where inference runs. Warp does not store the content of these requests. * **Team-managed API keys and endpoints** - When an admin configures [team-managed API keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/), the keys are encrypted and stored server-side, never synced to member devices, and never delivered to cloud agent environments. They're decrypted only in memory when serving a request. -* **Self-hosted cloud agent execution** - Repository clones, build artifacts, runtime secrets, and execution workspaces stay on your infrastructure. Orchestration metadata, session transcripts, and LLM inference requests and responses route through Warp and can include code context from agent interactions. +* **Self-hosted cloud agent execution** - Repository clones, build artifacts, runtime secrets, and execution workspaces stay on your infrastructure. Orchestration metadata, session transcripts, and LLM inference requests and responses route through Warp under ZDR, and can include code context from agent interactions. ### Encryption @@ -95,12 +96,22 @@ See [Secret Redaction documentation](/support-and-community/privacy-and-security ### Data retention +* **ZDR** - Warp's contracted LLM providers do not retain or train on your data * **Telemetry data** - When collected, Warp retains telemetry data indefinitely for analytics and debugging * **User accounts** - Data deletion requests are processed securely within 30 days at no cost, following verified authentication and compliance with legal and contractual obligations -## Security assessment materials +## Compliance and certifications -Contact [security@warp.dev](mailto:security@warp.dev) for current assessment materials and their scope. See the [Trust Center](/enterprise/security-and-compliance/trust-center/). +### SOC 2 Type II + +Warp is SOC 2 Type II certified, demonstrating compliance with industry-standard security controls for: + +* **Security** - Infrastructure protection, access controls, and monitoring +* **Availability** - System uptime and disaster recovery +* **Confidentiality** - Data protection and privacy controls +* **Processing integrity** - Accurate, complete, and authorized processing + +SOC 2 reports are available to Enterprise customers upon request. ## Infrastructure security @@ -108,16 +119,18 @@ Contact [security@warp.dev](mailto:security@warp.dev) for current assessment mat When using Warp's hosted infrastructure: -* **Cloud provider** - Hosted on GCP +* **Cloud provider** - Hosted on GCP with SOC 2 and ISO 27001 certified datacenters * **Network isolation** - Workloads run in isolated VPCs with strict network policies +Warp's operational security practices — including access controls, monitoring, and vulnerability management — are validated through SOC 2 Type II certification. See [Compliance and certifications](#compliance-and-certifications) for details. + ### Self-hosted deployments Enterprise teams can self-host cloud agent execution to control where agents run and keep repositories on their own infrastructure. Self-hosted deployments use a split architecture: * **Execution plane (customer-hosted)** - Repository clones, build artifacts, runtime secrets, and container filesystem state stay on your infrastructure -* **Control plane (Warp-hosted)** - Session transcripts (which include code context from agent interactions), orchestration metadata, and LLM inference route through Warp's servers +* **Control plane (Warp-hosted)** - Session transcripts (which include code context from agent interactions), orchestration metadata, and LLM inference route through Warp's servers under Zero Data Retention (ZDR) agreements. Warp does not persistently store your source code or use it for model training Two deployment modes are available: * **Unmanaged** - Use `oz agent run` to run agents in your existing orchestrator or CI environment. Supports Linux, macOS, and Windows with no Docker dependency. @@ -158,10 +171,11 @@ Security-relevant controls include: ### Bring Your Own LLM (BYOLLM) -Route agent inference through your own cloud provider account: +Route agent inference through your own cloud infrastructure for complete control: * **Data locality** - Interactive agent inference runs in your AWS account or Google Cloud project * **Cloud-native IAM** - Authenticate using your user's existing identity and access management process +* **No key storage** - Warp never stores your cloud credentials or API keys * **Billing control** - Inference costs billed directly to your cloud account See [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) for configuration details. @@ -208,11 +222,11 @@ Enterprise customers receive priority security support: ## Additional resources * [Warp privacy policy](https://www.warp.dev/legal/privacy-policy) -* [Warp Trust Center](https://trust.warp.dev) - Security documentation. See also [Trust Center](/enterprise/security-and-compliance/trust-center/) for vendor security review contacts. +* [Warp Trust Center](https://trust.warp.dev) — security documentation and compliance reports. See also [Trust Center](/enterprise/security-and-compliance/trust-center/) for details on requesting SOC 2 reports, subprocessors, and vendor security assessments. * [Warp subprocessors list](https://www.warp.dev/legal/subprocessors) * **Privacy documentation** - [Privacy guide](/support-and-community/privacy-and-security/privacy/) with complete telemetry table * **Contact** - [privacy@warp.dev](mailto:privacy@warp.dev) for privacy questions, [security@warp.dev](mailto:security@warp.dev) for security issues :::note -For vendor security assessments or compliance questionnaires, contact your account manager or email [security@warp.dev](mailto:security@warp.dev). +For vendor security assessments, compliance questionnaires, or access to SOC 2 reports, contact your account manager or email [security@warp.dev](mailto:security@warp.dev). ::: diff --git a/src/content/docs/enterprise/security-and-compliance/trust-center.mdx b/src/content/docs/enterprise/security-and-compliance/trust-center.mdx index c2e401423..c4aefffd5 100644 --- a/src/content/docs/enterprise/security-and-compliance/trust-center.mdx +++ b/src/content/docs/enterprise/security-and-compliance/trust-center.mdx @@ -3,15 +3,24 @@ title: Warp Trust Center sidebar: label: "Trust Center" description: >- - Find Warp's security documentation and contact the security team for - materials to evaluate Warp during your vendor security review. + Access Warp's security documentation, compliance certifications, and + third-party assessment resources to complete your vendor security review. --- -Use Warp's [Trust Center](https://trust.warp.dev) to find security documentation for your vendor review. +Warp's [Trust Center](https://trust.warp.dev) is the central hub for security documentation, compliance certifications, and third-party assessments. It provides the information security teams, procurement, and compliance officers need to evaluate Warp as a vendor and complete security reviews. -## Requesting assessment materials +## Compliance certifications -Contact [security@warp.dev](mailto:security@warp.dev) for current assessment materials and their scope. +### SOC 2 Type II + +Warp is **SOC 2 Type II certified**, demonstrating compliance with industry-standard security controls across the following trust service criteria: + +* **Security** - Infrastructure protection, access controls, and monitoring +* **Availability** - System uptime and disaster recovery +* **Confidentiality** - Data protection and privacy controls +* **Processing integrity** - Accurate, complete, and authorized processing + +**Requesting SOC 2 reports:** Enterprise customers can request SOC 2 reports directly through the [Trust Center portal](https://trust.warp.dev), through their account manager, or by emailing [security@warp.dev](mailto:security@warp.dev). ## Subprocessors @@ -19,12 +28,16 @@ Warp publishes a list of subprocessors — third-party service providers that pr View the current list of subprocessors at [Warp subprocessors list](https://www.warp.dev/legal/subprocessors). +:::note +Warp maintains **Zero Data Retention (ZDR)** agreements with its contracted LLM providers (Anthropic, OpenAI, Google, xAI), meaning they do not store or train on your data. +::: + ## Security documentation The following resources provide detailed information about Warp's security practices: -* **[Trust Center portal](https://trust.warp.dev)** - Security documentation for vendor reviews -* **[Security overview](/enterprise/security-and-compliance/security-overview/)** - Warp's security architecture and data handling +* **[Trust Center portal](https://trust.warp.dev)** - External portal with downloadable compliance reports and real-time security status +* **[Security overview](/enterprise/security-and-compliance/security-overview/)** - Warp's security architecture, data handling, and compliance certifications * **[Privacy policy](https://www.warp.dev/legal/privacy-policy)** - How Warp collects, uses, and protects personal data * **[Subprocessors](https://www.warp.dev/legal/subprocessors)** - Third-party service providers that process data on Warp's behalf @@ -32,12 +45,17 @@ The following resources provide detailed information about Warp's security pract If you're conducting a vendor security assessment or completing a compliance questionnaire, Warp can provide: +* **SOC 2 Type II reports** - Available upon request for Enterprise customers * **Compliance questionnaire assistance** - Warp's security team can help complete vendor security questionnaires * **[Architecture and deployment](/enterprise/enterprise-features/architecture-and-deployment/)** - Details about Warp's infrastructure, deployment models, and data flows To request any of these materials, contact your account manager or email [security@warp.dev](mailto:security@warp.dev). -## Responsible disclosure +## Penetration testing and vulnerability management + +Warp conducts regular security assessments as part of its SOC 2 program. The details of Warp's vulnerability management and penetration testing practices are validated through its SOC 2 Type II certification. + +### Responsible disclosure If you discover a security vulnerability in Warp, please report it responsibly: diff --git a/src/content/docs/enterprise/team-management/admin-panel.mdx b/src/content/docs/enterprise/team-management/admin-panel.mdx index 489ca1b30..a47140d88 100644 --- a/src/content/docs/enterprise/team-management/admin-panel.mdx +++ b/src/content/docs/enterprise/team-management/admin-panel.mdx @@ -19,6 +19,7 @@ The [Admin Panel](https://app.warp.dev/admin/) is your control center for managi * **Enforce security policies** - Configure secret redaction, telemetry controls, and data handling * **Manage team resources** - Enable Codebase Context, configure BYOLLM, and control sharing permissions * **Monitor usage** - Track consumption and configure spending controls +* **Maintain compliance** - Apply consistent policies that meet your organization's security requirements :::note Warp restricts Admin Panel access to team administrators. Regular team members can view settings that affect them but cannot modify organization-wide policies. @@ -105,6 +106,7 @@ The features available in the Admin Panel scale with your Warp plan: * **Enterprise secret redaction** - Custom regex patterns for secrets * **BYOLLM** - Route inference through your cloud infrastructure * **Self-hosting cloud agent workers** - Deploy cloud agent workers on your own infrastructure +* **Advanced compliance** - SOC 2 and custom data handling agreements * **Priority support** - Dedicated Slack/Teams channels For complete plan details, see [Warp pricing](https://www.warp.dev/pricing) or [contact sales](https://www.warp.dev/contact-sales). @@ -127,6 +129,7 @@ Configure how agents behave across your organization, including autonomy levels **Prompt summarization caching** * When conversations become long, the LLM provider caches summaries temporarily * Improves performance for extended agent interactions +* Zero Data Retention agreements cover caching (short-lived) #### Autonomy settings @@ -177,14 +180,16 @@ Command denylist rules take precedence over allowlist rules and agent autonomy s ### Privacy settings -Manage data collection and security settings for your organization. +Manage data collection and security policies to meet your organization's compliance requirements. **User-generated content (UGC) data collection** Controls how Warp collects and uses user-generated content to improve the service: -* **Disabled** - Disable UGC collection for service improvement +* **Disabled** - Warp collects no UGC data from your organization * **Enabled** - Allow data collection for service improvement * **Respect User Setting** - Let individual users decide +Enterprise teams with Zero Data Retention agreements can disable this completely. + **Enterprise secret redaction** Automatically detects and redacts sensitive information before sending data to LLM providers: * Enterprise plans enable this by default @@ -219,7 +224,7 @@ From the **Models** page, admins can also create team-synced [custom routers](/a **Models with provider-specific data retention requirements** -Some models have provider-specific data retention requirements. For Enterprise teams, these models are **disabled by default**. A workspace admin must explicitly enable them before team members can use them. +Some models require data retention from the model provider and are therefore not available under [Zero Data Retention (ZDR)](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr). For Enterprise teams, these models are **disabled by default**. A workspace admin must explicitly enable them before team members can use them. ### Billing settings diff --git a/src/content/docs/factories/self-hosting/security-and-networking.mdx b/src/content/docs/factories/self-hosting/security-and-networking.mdx index 49b5e6249..343c8e1c6 100644 --- a/src/content/docs/factories/self-hosting/security-and-networking.mdx +++ b/src/content/docs/factories/self-hosting/security-and-networking.mdx @@ -117,7 +117,7 @@ See [GitLab](/platform/integrations/gitlab/) and [Bitbucket](/platform/integrati ## LLM inference and BYOLLM -The Warp Agent sends inference requests through Warp to LLM providers. With customer-supplied inference, provider-side retention follows your team's agreement with that provider. +The Warp Agent sends inference requests through Warp. With Warp-managed inference, requests go to contracted providers covered by [ZDR](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr) agreements. With customer-supplied inference, provider-side retention follows your team's agreement with that provider. Teams that want inference routed and billed through their own accounts can use [team-managed model keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) or [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/). Plan requirements and cloud agent support vary by option; see [inference options for factory runs](/factories/infrastructure-and-security/#inference-options-for-factory-runs). @@ -131,6 +131,6 @@ Claude Code and Codex send inference requests directly to their providers under * [Unmanaged execution](/platform/unmanaged-execution/) - Run standalone agents from your own CI or scheduler * [About factory infrastructure and security](/factories/infrastructure-and-security/) - Choose execution, inference, and credential boundaries * [Data security and boundaries](/platform/architecture/#data-security-and-boundaries) - Review where each class of data lives and travels -* [Security overview](/enterprise/security-and-compliance/security-overview/) - Review Warp's security controls and data flows +* [Security overview](/enterprise/security-and-compliance/security-overview/) - Review Warp's security model and ZDR * [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) - Route inference through your own cloud provider accounts * [Self-hosted worker reference](/factories/self-hosting/reference/) - Look up worker flags and configuration diff --git a/src/content/docs/platform/architecture.mdx b/src/content/docs/platform/architecture.mdx index b02d244b4..3d05fd887 100644 --- a/src/content/docs/platform/architecture.mdx +++ b/src/content/docs/platform/architecture.mdx @@ -34,7 +34,7 @@ Every cloud agent run follows the same lifecycle, no matter what started it or w 2. **The task is created** - The control plane opens a run record that tracks the task's state, inputs, and provenance. 3. **Configuration is resolved** - The platform picks the run's [environment](/factories/environments/), [runner](/factories/runners/), execution host, and [model and harness](/factories/harnesses/). 4. **The sandbox is provisioned** - The execution host clones the environment's repositories, runs setup commands, and injects only the [secrets](/platform/secrets/) the run is allowed to use. -5. **The agent loop runs** - The harness gathers context, calls the model, and runs tools until the task is done. Tools run in the sandbox. With the Warp Agent, model calls route through Warp to providers; Claude Code and Codex call their provider directly. +5. **The agent loop runs** - The harness gathers context, calls the model, and runs tools until the task is done. Tools run in the sandbox. With the Warp Agent, model calls route through Warp to providers under [Zero Data Retention](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr); Claude Code and Codex call their provider directly. 6. **Outputs land at their targets** - The agent pushes branches, opens pull requests, and replies to the Slack thread, Linear issue, or Jira work item that started the task. 7. **The run record persists** - Transcripts, artifacts, and cost data attach to the run record. 8. **The team has visibility** - Authorized users follow the run in the {VARS.DASHBOARD} or attach to it with [Agent Session Sharing](/agents/local-agents/session-sharing/). @@ -60,7 +60,7 @@ Self-hosted execution keeps checkout, commands, and the workspace on your infras 2. **Warp assigns the task** - When a trigger targets your worker, the control plane sends the task, its resolved configuration, and scoped runtime credentials over that connection. 3. **The agent runs on your backend** - The worker clones repositories, runs setup, injects allowed [secrets](/platform/secrets/), and executes in a Docker container, a Kubernetes Job, or directly on the host, depending on the [managed backend](/factories/self-hosting/#managed-architecture) you chose. Code, build artifacts, and workspaces stay on your machines. 4. **Run data returns to Warp** - Status, transcripts, artifacts, attachments, and telemetry flow back for the run record. Content the agent puts into prompts or results can include code context; see [execution security](/factories/self-hosting/security-and-networking/). -5. **Warp routes inference** - With the Warp Agent, model calls go from your worker through Warp to LLM providers, or through your own provider account with [team-managed keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) or [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/). Claude Code and Codex call their provider directly from your infrastructure. +5. **Warp routes inference** - With the Warp Agent, model calls go from your worker through Warp to LLM providers under [Zero Data Retention](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr), or through your own provider account with [team-managed keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) or [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/). Claude Code and Codex call their provider directly from your infrastructure. 6. **Your team monitors the run** - Runs on self-hosted workers appear in the {VARS.DASHBOARD} and support [Agent Session Sharing](/agents/local-agents/session-sharing/), the same as Warp-hosted runs. ### Self-hosted sequence view @@ -73,7 +73,7 @@ This sequence diagram shows the requests and responses exchanged among a trigger 2. **Assign task** - The control plane delivers the task over the worker's authenticated connection, with resolved configuration and scoped runtime credentials. 3. **Prepare workspace** - The worker clones repositories, runs setup commands, and injects allowed secrets. 4. **Prompt and context** - The agent gathers context inside the sandbox and sends it for inference. -5. **Inference** - Model calls from the Warp Agent route through Warp to LLM providers, or through your own provider account with team-managed keys and endpoints or Bring Your Own LLM. +5. **Inference** - Model calls from the Warp Agent route through Warp to LLM providers under ZDR, or through your own provider account with team-managed keys and endpoints or Bring Your Own LLM. 6. **Run tools** - Tool calls execute locally: files, commands, internal services, and MCP servers. 7. **Results** - Transcripts, tool outputs, and lifecycle updates return to the run record. 8. **Outputs** - The agent pushes a branch, opens a pull request, and replies to the integration that started the run. @@ -94,7 +94,7 @@ Every run moves a few distinct classes of data, and each class has its own bound ![Warp-hosted data security and boundaries diagram showing repositories, clients, and integrations in customer infrastructure, the per-run sandbox and control plane on the Warp platform, model providers, and Warp-managed run-data storage](../../../assets/agent-platform/warp-hosted-data-boundaries.png) * **Source code** - For Warp-hosted runs, repositories are cloned into an isolated per-run sandbox and destroyed with it; Warp does not persistently store repository clones or train on your code. For [managed self-hosting](/factories/self-hosting/), checkout and the workspace stay on your infrastructure. Either way, code context the agent puts into prompts, transcripts, or artifacts transits Warp and may persist as run data. -* **Prompts and context** - With the Warp Agent, model calls route through Warp to LLM providers. [Team-managed keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) and [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) keep the same route but use your provider account. Claude Code and Codex call their provider directly from the execution environment under your provider agreement. +* **Prompts and context** - With the Warp Agent, model calls route through Warp to LLM providers under [Zero Data Retention](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr) agreements: providers don't retain or train on the traffic. [Team-managed keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) and [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) keep the same route but use your provider account. Claude Code and Codex call their provider directly from the execution environment, under your provider agreement rather than Warp's. * **Run data** - Transcripts, artifacts, and run attachments are stored in Warp-managed storage, encrypted at rest and access-controlled by your team's roles. * **Control-plane data** - Warp always retains what it needs to operate the platform: user and organization settings, agent and factory configuration, orchestration and lifecycle metadata, trigger and integration metadata, operational logs, and usage and billing. * **Execution secrets** - Secrets you inject locally never transit Warp. [Managed secrets](/platform/secrets/) are stored encrypted and fetched just-in-time by the execution environment with a run-scoped token, and each delivery is audit-logged. Agents can also obtain short-lived cloud credentials at runtime through [workload identity federation](/platform/integrations/cloud-providers/) instead of holding long-lived secrets. [Secret redaction](/support-and-community/privacy-and-security/secret-redaction/) at output boundaries is a backstop, not a substitute for narrow scopes and rotation. diff --git a/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx b/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx index b1568bdfb..c2a43dab4 100644 --- a/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx +++ b/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx @@ -41,7 +41,7 @@ Warp offers two options for larger teams and organizations: If you’d like to explore Enterprise, [contact our sales team](https://www.warp.dev/contact-sales) and someone from Warp will follow up. ::: -Traffic you route through your own API key or a custom inference endpoint is subject to your provider's data-retention policies. Review [data collection controls](/enterprise/security-and-compliance/security-overview/#data-collection-controls) separately from provider retention terms. +For Warp-managed model traffic (requests Warp routes to OpenAI, Anthropic, Google, or xAI on your behalf), all plans are covered by Warp's Zero Data Retention (ZDR) agreements with the underlying model providers. Traffic you route through your own API key or a custom inference endpoint is governed by that provider's data-retention policies, not Warp's agreements. Admin-configurable data controls — including team-wide retention policies and training opt-outs — are available on Business and Enterprise. ### What counts as a team member and how does billing work for members? @@ -236,23 +236,31 @@ Warp Drive data is securely stored on Google Cloud Platform servers located in t For more details, [visit the Security Overview](https://www.warp.dev/legal/security) or contact [security@warp.dev](mailto:security@warp.dev). - +### Does Warp have a SOC 2 Type 2 attestation? -### Where can I find security assessment materials? +Yes. Warp has obtained a SOC 2 Type 2 attestation from an accredited third party. See the [Trust Center](/enterprise/security-and-compliance/trust-center/) to request the report. -See the [Trust Center](/enterprise/security-and-compliance/trust-center/) and contact [security@warp.dev](mailto:security@warp.dev) for current assessment materials and their scope. +### Does Warp have Zero Data Retention policies with LLM providers? - +Warp integrates with multiple LLM providers — including Anthropic, OpenAI, Google, xAI, and Fireworks AI — to power its AI features. Warp has executed Zero Data Retention (ZDR) agreements with these providers. Across all plans, these agreements mean: -### Where can I confirm model-provider retention terms? +* LLM providers commit not to train their models on any customer-generated data processed through Warp's services. +* LLM providers commit to delete inputs and outputs after generating the relevant output, within a fixed time period. -Contact [security@warp.dev](mailto:security@warp.dev) to confirm the applicable terms for your model, provider, and inference configuration. +Warp enforces these commitments through both technical measures and contractual safeguards with the LLM providers. - +Zero data retention is available for supported models. Model availability may vary where providers require data retention for safety, abuse monitoring, or compliance reasons. -### Does disabling telemetry change provider retention? +### How can I enable Zero Data Retention in Warp? -Telemetry controls and model-provider retention are separate. See [Privacy and data control](/support-and-community/privacy-and-security/privacy/) for telemetry settings; confirm provider terms separately before choosing an inference configuration. +Zero Data Retention (ZDR) can be enabled in two ways: + +* **Individual level** — Any user can enable full ZDR for their own account by disabling **Help Improve Warp** in **Settings** > **Privacy**. +* **Organization-wide** — On Business and Enterprise plans, admins can enforce ZDR for all members from the [Admin Panel](/enterprise/team-management/admin-panel/), so team-wide compliance doesn't rely on individual settings. + +To discuss organization-wide ZDR for your team, [contact our sales team](https://www.warp.dev/contact-sales). + +Regardless of plan, Warp never allows OpenAI, Anthropic, Google, xAI, or other model providers to store, retain, or train their models on your data — see [Does Warp have Zero Data Retention policies with LLM providers?](#does-warp-have-zero-data-retention-policies-with-llm-providers) for details. ### Can I bring my own API key? diff --git a/src/content/docs/support-and-community/privacy-and-security/privacy.mdx b/src/content/docs/support-and-community/privacy-and-security/privacy.mdx index 35f8f5d88..16c047343 100644 --- a/src/content/docs/support-and-community/privacy-and-security/privacy.mdx +++ b/src/content/docs/support-and-community/privacy-and-security/privacy.mdx @@ -33,6 +33,10 @@ If you haven't opted out of "Help improve Warp", we may collect: Telemetry must be enabled to use AI features on the Free plan, while paid plans can opt out at any time and continue using Warp, including AI. ::: +:::caution +Business and Enterprise plans are covered by our Zero Data Retention (ZDR) agreement. No AI interaction or console data is ever collected. +::: + Selling usage data will never be part of Warp's business model. This data is used solely to improve the end-user experience. Warp uses Sentry for crash reporting and Rudderstack for app analytics. You can read our [full privacy policy](https://www.warp.dev/legal/privacy-policy) as well as [how Warp handles security](https://www.warp.dev/legal/security). @@ -44,7 +48,7 @@ You can read our [full privacy policy](https://www.warp.dev/legal/privacy-policy ![Privacy Settings](../../../../assets/support-and-community/privacy-settings-after-signup-1.png) -Telemetry controls are separate from storage needed for product features such as [cloud conversations](/enterprise/security-and-compliance/security-overview/#data-collection-controls). Disabling telemetry does not establish model-provider retention terms. +With telemetry disabled, no console interactions are ever persisted on Warp's servers. Each request contains a `X-Warp-Telemetry-Enabled` header to specify whether telemetry is disabled, and even if this is missing from the request, our server assumes it's disabled. ### Delete your account and data