Trust and security
Answers for security reviewers and operations leaders: where agents run, how they sign in, what waits for a person, what goes on record and how to stop them.
At a glance
Where agents live
License Sidekick Sovereign, or have our engineers build in your environment. Either way, your agents run in your cloud, and your people reach them in Microsoft Teams.
No SaaS. Zero bits flow to us. You keep 100% of everything, keys included.
Engineering in your environment
Our engineers work inside your environment. Your agents run in your cloud, next to your data.
Your cloud
Licensed Sidekick Gateway and Sidekick Memory run in your own environment too.
Sidekick Sovereign
Every Sidekick product as your own private copy, shared with no other customer. AI models run through your own Microsoft Foundry.
Your Microsoft Azure
Plant networks: Sidekick Connectors move data outbound only, so your plant network never opens up to cloud services.
Sidekick ConnectorsWho does what
Both setups, side by side. Your keys stay with you in both.
| Way of working | Who hosts | Who operates | Who holds keys | Who can stop agents |
|---|---|---|---|---|
| Sidekick Sovereign in your Microsoft Azure | You, in your own Microsoft Azure. A private copy, shared with no other customer. | Us, as our core service. Or your team, if you prefer. | You. Always. Agents never see passwords or keys. | You. Any agent, or all of them at once. |
| Engineering in your environment | You, in your own cloud. Our engineers work inside your environment. | Us, as our core service. Or your team, if you prefer. | You. Always. Agents never see passwords or keys. | You. Any agent, at any time. |
How agents sign in
Never with a person’s password. Agents never see passwords or keys.
Every agent has its own identity and never borrows a person’s, so your records show which agent acted.
Each agent can use just those tools and actions approved for it. Anything else is refused.
We scope its access to its job and revoke access when that job changes.
Modern and legacy sign-in methods both work, so older enterprise systems can join in.
With Agent Studio, each new agent gets its own Microsoft Entra identity and Microsoft 365 account. Agent Studio
What needs a person
A person approves that exact request. One approval covers one request, and nothing more.
You tell us which decisions stay with a person. We set which actions wait for approval.
An approval covers that one request. A different request waits for a person again.
Who approved what, and when.
New agents need sign-off too: in Agent Studio, choose none, one or two approvers, as your policy says. Nobody approves their own request.
What goes on record
Every request, check and approval is recorded: who approved what, and when.
Every action, handoff and approval is on record, ready when auditors ask.
Agent Studio keeps a tamper-evident audit trail you can export.
Everything Sidekick Memory remembers and recalls stays on record.
Stopping agents
You can stop any agent at any time. With Agent Studio and Sidekick Sovereign, one click stops one agent, or every agent at once, with a full audit trail.
See every agent in one place, and stop any one of them with one click.
Sidekick Gateway has no central gateway, so a problem stays contained and other agents keep working.
For security teams
A decentralized MCP gateway: human approval for sensitive actions, every request on record.
See Sidekick Gateway ProductEvery Sidekick product as a private copy in your own Microsoft Azure.
See Sidekick Sovereign EngineeringPut identity, permissions, human approvals and secure execution into practice.
See Agent SecurityReviews and privacy
Security questionnaires and reviews are available on request. Send yours, or ask for a call with our engineers.
This website sets no cookies and loads no third-party scripts. Customer engagements run under their own signed agreement, which covers data handling, security, residency and audit terms.
Responsible disclosure
Think you’ve found a vulnerability in our website or software? Here’s how to report it.
Email security@sidekickmachines.com with subject “Security issue”.
What you found, where, and steps to reproduce it.
Please give us time to fix an issue before you share details publicly.
While testing, please stay clear of other people’s data and avoid disrupting service.
This contact also appears in our security.txt file
Security review
Send your questionnaire or ask for a review call. Our engineers answer in plain words.
Microsoft, Microsoft 365, Microsoft Azure, Microsoft Entra, Microsoft Foundry, and Microsoft Teams are trademarks of the Microsoft group of companies.
