Security
What follows is what the published package does. Anything not listed here is not a claim.
Chariot is self-hosted. There is no Chariot control plane. Audit records and the credential vault never leave your network. In air-gapped mode there is no outbound connection at all. In connected mode the only Epic AI®-operated server Chariot contacts is the license host, to renew your license. If you choose a public LLM provider, Chariot also contacts that provider. Operational telemetry is off by default. Nothing is sent unless you both opt in and separately select automatic transport; then the license host receives nine non-sensitive metadata fields, never queries, arguments, results or credentials.
The integration catalog is signed with Ed25519. Chariot verifies the signature when it loads the catalog and refuses a catalog whose signature does not match the production public key built into the package. One hardening step remains open: custody of the production signing private key in AWS KMS.
Sign in through your identity provider (SAML or OIDC) and provision users with SCIM. A user’s roles narrow which integrations their AI client is shown, so a person never receives the tool definitions of an integration they are not allowed to use.
Integration credentials are stored encrypted with AES-256-GCM, using a key derived per tenant.
Each tool call is classified auto, escalate or approve. Read-only calls run. Escalate calls run and notify a person. Approve calls wait for a human. A tool Chariot has no rule for is treated as approve.
Every dispatched action is written to a hash-chained, append-only audit trail. Altering or removing a record breaks the chain, so tampering is detectable.
Write to security@epic-ai.io. The source is available under the Elastic License 2.0, so you can read what the package does.