Where credentials live
Doing it by hand: API keys pasted into each agent's config.
With Spinrun: Connected once through OAuth and kept in an encrypted vault.
Spinrun for enterprise
Company-wide rules foryour agents. (also rotates through: your agents., your models., your apps.)
Put every agent and model behind one endpoint, with read, write and destructive rules enforced on each call and a log your security team can read. Volume, terms and onboarding are agreed with you.
- Data hosted in Frankfurt
- Credentials encrypted at rest
- Every call logged
- Not used to train models
How it works
Rules, keys and a record, decided once
- Salesforce
- readRuns on its own
- writeWaits for approval
- destructiveBlocked
Rules the gateway enforces, not a prompt
Every tool is sorted into read, write or destructive, and each app gets its own rule. A blocked call never reaches the app; the agent gets an error naming the rule, and the attempt is logged.
- Workspace keys
- sales-agentsActive
- support-agentsActive
- finance-pilotRevoked
Cut off one team without breaking the rest
Each workspace key is scoped to one team and the apps it's allowed, with limits of its own. Revoking it stops that team's agents and nothing else.
- SALESFORCE_UPDATE_OPPORTUNITYAllowed
- SLACK_SEND_MESSAGEAllowed
- SALESFORCE_DELETE_ACCOUNTBlocked
Enterprise- Activity log retention365 days
- Payload retention90 days
Every call on the record
The log records the user, the tool, the action and the outcome of every call, blocked ones included. Your plan sets how long it and the call payloads are kept, and a nightly job enforces it.
What agents take on
Work that crosses departments
Each one is already a template or a department page, running on the same gateway.
Answers from company knowledge
Ask a question and get the answer from your docs and wikis, with the source cited.
TemplatePipeline health, every week
Deal data from Salesforce, broken down by stage and owner, in one weekly report.
TemplateCustomer context in one summary
Account details, open tickets and recent activity for a customer, pulled together before a call.
TemplateIT and security busywork
Alert triage, access requests, incident notes and audit prep across PagerDuty, Datadog, Auth0 and Cloudflare.
Department
Toolkits
Connected once, governed everywhere
A person connects each app once; every agent reaches it through the gateway, under that app's rules.
177 more apps connect the same way
- OAuth, no shared passwords
- Credentials encrypted at rest
Side by side
One gateway instead of a setup per department
Each department still picks its own agent. Identity, rules and logging are decided once, for all of them.
The job
Doing it by hand
With Spinrun
Where credentials live
Doing it by hand: API keys pasted into each agent's config.
With Spinrun: Connected once through OAuth and kept in an encrypted vault.
What an agent may do
Doing it by hand: A line in the prompt asking the model to be careful.
With Spinrun: Read, write and destructive rules per app on Pro and up, enforced at the gateway on every call.
Cutting off one team
Doing it by hand: Rotating every key that team ever used.
With Spinrun: Revoking one workspace key, while every other team keeps running.
The audit trail
Doing it by hand: Each tool's own logs, in each tool's own format.
With Spinrun: One log of every call, blocked ones included, kept as long as your plan sets.
What an agent may do
Doing it by hand: A line in the prompt asking the model to be careful.
With Spinrun: Read, write and destructive rules per app on Pro and up, enforced at the gateway on every call.
Cutting off one team
Doing it by hand: Rotating every key that team ever used.
With Spinrun: Revoking one workspace key, while every other team keeps running.
The audit trail
Doing it by hand: Each tool's own logs, in each tool's own format.
With Spinrun: One log of every call, blocked ones included, kept as long as your plan sets.
Who it's for
For organizations rolling agents out department by department
Sales picks one agent, support another, engineering a third. Spinrun puts them all behind one governed endpoint, so identity, rules and logging are decided once instead of tool by tool.
Rules set centrally and enforced on every call
Credentials encrypted at rest, never in an agent's config
Tenants isolated from each other in the database
Enterprise plan
What Enterprise includes
All of Pro, and: volume, terms and onboarding agreed with you, a dedicated SLA and an account team. Pricing is quoted.
Enterprise
Your volume, your auditors, your terms.
- credits / month
- Custom
- connections
- Unlimited
- team members
- Unlimited
- All of Pro, and:
- Custom volume, terms & onboarding
- Dedicated SLA & account team
Use cases
Recipes to start from
Ahead of the security review
All of Pro, and: custom volume, terms and onboarding, a dedicated SLA and an account team. Enhanced Control, the Brain, artifacts, the code sandbox and the agent database come with it from Pro, and members, connections and API keys are uncapped.
Plan your rollout with us.
Tell us about your volume and how your security review works, and a person from the team will reply with the next steps.