Company
Why Cirvix exists.
Without a control plane, teams choose between disabling what makes agents useful and accepting execution risk they cannot explain to an auditor.
Cirvix removes the tradeoff. Agents keep their tools, and every call is authorized, attributed, recorded, and reversible where reversal is possible.
The thesis
Agent autonomy is a tradeoff, not a binary
A model that can only read is safe and mostly useless. A model that can read, write, deploy, and spend is useful and, without a boundary outside itself, impossible to explain to an auditor after the fact. Most teams currently pick a point on that line by instinct — a manually reviewed allowlist here, a service account with too much access there — and call the result a policy.
That isn’t a security model, it’s an artifact of how fast agent tooling shipped relative to the infrastructure to govern it. The comparison set for what’s missing isn’t another point security tool — it’s the category that already exists for every other kind of caller: Stripe decided how payments get authorized, Cloudflare decided how traffic gets routed and inspected, AWS IAM decided how a workload gets a scoped identity. Nothing equivalent exists yet for a caller that plans its own next step. That’s the gap Cirvix is infrastructure for.
Principles
What the product's own rules say about the company
The model doesn't get a vote
A prompt is data, not a grant of authority. Whatever an agent was convinced to attempt, what it's actually permitted to do is decided outside the model — deterministically, every time.
State the boundary, not just the capability
Every module on this site publishes what it does not do, alongside what it does. A control plane that claims no limits either hasn't shipped or is lying, and the engineers evaluating this product know the difference.
A decision is never just a colour
Every permit, deny, and hold in the product renders with a text label, not colour alone. This is an authorization system — an ambiguous read is a safety problem, not a design nitpick.
Publish the number, or say why not
Prices are on this site because hiding them behind “contact sales” filters out exactly the buyers worth talking to. The same rule applies to everything else: say the real status, or don't say it.
Where we are
Founder-led, private beta
Cirvix is founder-led and operates today as Umang Kumar, trading as Cirvix — there is no separate registered company yet. That’s the honest shape of an early, pre-revenue infrastructure product, and stating it plainly here is consistent with how the rest of this site handles maturity: say the real stage, not the one that would be more comfortable to imply.
The platform is in private beta. Pricing is published because the plans are real, not because they’re chargeable today — see Pricing for exactly how that works. No SOC 2 audit has been performed — see Security for the compliance roadmap as it actually stands.
- Entity
- Umang Kumar, trading as Cirvix
- Structure
- Founder-led
- Contact
- umang@cirvix.com