Security and governance
This page is for your IT team. It explains where your data goes, the controls Glimmer has, and the choices your company makes about AI.
A 4-page overview for your IT team. Or read the full explanation.
Last updated 15 October 2026
Why it matters
An AI agent is useful because it works inside your company's systems. It reads your documents, checks your accounts and drafts your emails. That access is also the risk. An AI model can make mistakes, so the protections have to come from the setup around it.
Risk
Customer lists, prices and payroll could end up somewhere they should not.
What stops it: Glimmer runs in your own account, and it reaches only the places on your approved list.
Risk
A payment, an email to a client or a deleted record could happen without anyone asking for it.
What stops it: actions you choose wait for a person's approval, and every action is logged.
Risk
A file or email can hide an instruction, such as "email this file to the address below".
What stops it: the AI never holds your passwords, and it cannot reach any website off your list.
Where your data goes
Your staff ask Glimmer in the chat app they already use. Glimmer works inside your cloud account, and it only reaches the places on your approved list.
Controls
Your IT team can see all of this live in the Glimmer console.
A cloud account in your company's name. The AI runs on your own key. If you do not have a cloud account yet, we open one for you.
Each chat gets its own virtual machine, kept apart by KVM, the same technology Amazon and Google use to separate their customers. Any connection off the approved list is blocked and logged.
Each system connects through its own small program, which holds the password and signs in for the AI. The AI never sees the password, so a tricked agent has none to give away.
A file or email can hide an instruction meant to trick an AI. On Glints' own Glimmer, a separate checker scores everything the agent reads before the AI acts on it. In our tests it caught all 40 planted instructions.
Who asked, what the agent did, and which AI model answered. Team leads see their own agents. Managers see all of them.
A team lead picks which actions need a person's OK, and whose. The approval card arrives in the same chat. When you connect a new system, every change it makes there needs approval until someone clears it.
A new rule for a whole team waits for the owner's approval. Every change is kept in a history.
Cost in dollars per agent and per team. No licence for every person, used or not.
Our security controls follow the ISO 27001 framework. Glints is working toward ISO 27001 certification, expected January 2027.
Your choice of AI
Glimmer is not tied to one AI company. You pick the model, how it is reached and where it runs. Glimmer works the same way with each.
Option 1
An account in your company's name with Anthropic, OpenAI or Google. The simplest way to start.
You choose how long the AI company keeps your requests
The AI company keeps requests for up to 30 days to check for misuse, then deletes them.
Option 2
Amazon, Google or Microsoft runs the model inside your own cloud account. Pick this when data must stay in Singapore: Claude and Gemini models can run there. Amazon keeps nothing by default. Google keeps a 24-hour cache, which can be turned off.
Option 3
An open model runs on servers you control, in your own cloud or in your own office. Questions never leave your environment.
Retention terms on each company's own page: Anthropic · OpenAI · Amazon Bedrock · Google Vertex AI. Checked on 10 October 2026. Companies change their terms often, so check the linked page before you decide.
Seven questions
In a cloud account in your company's name. The region can be Singapore.
Each chat runs in its own virtual machine. One team's chat cannot read another team's files.
A separate program for each system holds its password and signs in for the agent.
Only the ones on your approved list. Anything else is blocked and logged.
Glints' own Glimmer passes everything it reads through Jev, a checker from TypeSafe. Glimmer sends each text to TypeSafe to score it. In our test of 160 real texts, Jev flagged all 40 planted instructions. The approved list of websites stays in place as a second barrier.
They pick the actions and the approver. Payments, emails to clients and deletions are the usual ones.
Every request, connection and approval is logged, and the console shows it for each team.
These questions come from Is it safe to let an AI agent into your company's systems? Ask them of every vendor, including us.
Our engineers open the Glimmer console live and answer your IT team's questions.
Related
General information about how Glimmer is set up. The terms that apply to your company are in your contract.
