For IT providers · security
Answers to the security questions clients ask
Short answer: two controls are set by the installer and measured on our demo unit (1 Oct 2026); eight, including firewall and key-only SSH, are set at each install. There is no SOC 2.
A client's questionnaire for an AI vendor mostly asks the same dozen things. The honest answer differs by row: some controls we have measured, some are a plan for each install, and some do not exist yet. Each answer below is tagged by its evidence. Send your client's own form to partners@staffbox.ai and we fill it in, gaps included.
Updated 14 October 2026
Twelve standard questions, each answered and tagged by how we know
"Installed unit" means after the client's test has passed. Where a row says "demo unit" we measured it on our own Mac mini on 1 October 2026; where it says "set at install" it is done per site and written in that site's install record. The chart sorts the controls behind those answers by that evidence.
| Question | Answer |
|---|---|
| What hardware does it run on? | An Apple Mac mini on the client's network, owned by Staffbox during a pilot. |
| Is the disk encrypted? | FileVault is turned on before any customer data is loaded (set at install; checked with fdesetup status and noted in the install record). |
| Which AI models run, and where? | Open-weight models through Ollama on 127.0.0.1 only (demo unit). No cloud fallback provider is configured (demo unit). Cloud only if the client asks in writing and supplies its own key. |
| What can it read? | The folders and mailbox agreed in writing at install. In the quote pilot: forwarded quote requests and one price-list file. |
| What can it write? | Draft replies into a drafts folder and one log line per task. It has no permission to send email or delete files (set at install). |
| What does the network look like? | macOS firewall and stealth mode: set at install by your IT provider from our checklist (not yet automated in the installer; an opt-in hardening step is in review); verified on our demo unit 1 Oct 2026. No inbound ports except SSH. Ollama and the Hermes dashboard (127.0.0.1:9119) listen on loopback only. |
| How do you get in remotely? | SSH keys only, password login off: set at install by your IT provider from our checklist (not yet automated in the installer; an opt-in hardening step is in review); verified on our demo unit 1 Oct 2026. Keys belong to named people. Sessions are agreed with the client's IT contact in advance. macOS logs every SSH login. |
| What leaves the box? | No customer data. An outbound traffic allowlist is planned, not in place: installs and updates download Hermes, Ollama, models and Obsidian, and macOS makes its normal update connections. |
| How are updates handled? | Manual today: we re-run your tests before and after each monthly update. A scripted update and rollback are in review. |
| Is customer data used for training? | No one trains a model on customer data. |
| What happens at exit? | The unit is returned or wiped in front of the client. Staffbox deletes its copies within 14 days and confirms in writing. |
| Which certifications do you hold? | None. No SOC 2 or other certification. No cyber or errors-and-omissions insurance is confirmed. |
The AI questions come down to one fact: the unit writes drafts and nothing else
Generic forms often miss the questions that matter for a model that reads email. Most of them resolve the same way: the worker has no sending code, its terminal and code-execution tools are off, and a person is behind every reply. Here are the ones we expect, with our answers.
| Question | Our answer | Status |
|---|---|---|
| Can the model send mail or delete files? | No. Staffbox has no sending code. Sending and deleting are turned off at install. Whether the mail platform also blocks them at the permission level depends on the platform, and we tell you in writing before install. | fact |
| Can it run commands or browse the web? | The default install turns off nine tool groups (terminal, code execution, browser, computer use, web, connections, delegation, cron jobs, text-to-speech) plus image generation. The file and skills tools stay on, so the agent can still write files the unit's user can write; that is why the unit holds only your price list and notes, a person approves every draft, and a write safe-root and a separate low-privilege user are in review. Today a failed disable warns rather than stops the install (fix in review). | fact |
| What if a customer email contains hostile instructions? | Inbound mail is treated as untrusted and the worker only drafts. We have not published test results for injection attempts yet. They are listed as planned. | goal |
| Can the model be wrong? | Yes. On 6 October 2026, 11 of 475 answers on fictional test sets were misses, 10 of them declining. Every draft is checked by a person. | measured |
| Whose models are they? | Open-weight models run locally. The default is Alibaba's Qwen. A non-Qwen option, OpenAI's gpt-oss-20b, needs 32 GB. Buyers who cannot use Alibaba products should read the non-Chinese model page. | fact |
| Is the code open? | Yes. MIT licence at github.com/Staffbox-ai/staffbox. The agent underneath is Hermes Agent by Nous Research. Staffbox is not affiliated with Nous Research. | fact |
On a new trade it had never seen, an electrical distributor (14 Oct, Dell test box), the default Qwen3 8B setup scored 30 of 40 and 2 of 15 on messy requests, with 8 wrong prices in 55, because per-foot units, price levels and trade shorthand are not handled yet; that is why we score your own list first (the electrical result).
The gaps are stated plainly: no SOC 2, no insurance confirmed, no customer install
No customer unit exists, so every row marked "set at install" is a plan until the first install. Several answers that IT providers ask for are listed as planned on the Trust Center: the remote access path, the update path, an outbound traffic allowlist, incident notification time, key custody, log forwarding, backup and replacement, and prompt-injection test results. Our own systems also have gaps, such as a shared cloud account and review that is not yet enforced before release. The Trust Center lists each with its status.
If a form needs a signed statement, we sign nothing outside a pilot agreement. The agreement controls over any web page.
Answer with evidence, and never paste a demo-unit answer into a customer form
Questionnaires from clients usually come in one of three shapes: a spreadsheet of yes/no rows, a vendor-risk portal, or a letter from the client's insurer. The answers are the same in all of them. Three habits keep you out of trouble.
- Answer "no" where it is no. A form that asks for SOC 2 gets "No, not started." The Trust Center says the same. A row left blank looks worse than a plain no.
- Separate the demo unit from the install. A demo box with no customer data can run the installer with an override (DEMO_UNIT=1 in scripts/install.sh), so a demo unit's answer may differ. A customer unit must pass the FileVault check. Do not paste a demo-unit answer into a customer form without that change.
- Attach evidence, not adjectives. The install record from the install checklist carries the command outputs. Attach that.
Questions
Do you have SOC 2?
No. SOC 2 has not been started, and no start date is set. The Trust Center and the open code are what you can check today.
Does customer data leave the unit?
No customer data leaves the box. An outbound traffic allowlist is planned, not in place: installs and updates download Hermes, Ollama, models and Obsidian.
Can you fill in our own questionnaire?
Yes. Send it to partners@staffbox.ai and we answer directly, gaps included.
Sources
- How we measured: two fictional companies (Fieldstone IT, Peachtree Cabinet Works), graded by code, Qwen3 8B on a 16 GB Mac mini M4 (Dell RTX 3090 for the 30 Sep runs), 30 Sep to 6 Oct 2026. No customer has run Staffbox yet.
- Staffbox Trust Center, security sheet and controls, 13 Oct 2026.
- Staffbox-ai/staffbox (MIT), pull requests #6 and #7.
- Hermes Agent by Nous Research (MIT).
Or call us: 404 493 6248 · How the free test works