Security, controls and deployment
Shipped, planned, and yours to decide
Read-only access is the default posture, and proposed actions stop at your engineer.
Every row below carries a status label: shipped is not the same as planned.
Content review 2026-07-22 · this page is a statement of practice, not a certification
An agreed path, or no path
Five gates, named before evaluation starts: source, credential scope, evidence, audience, action owner.
The source gate is planned; the platform page labels all five.
Every control, with its status
Where a control is not shipped, this table says so rather than implying otherwise.
| Control | Published fact | Status |
|---|---|---|
| Human approval | Every remediation waits for a person. Proposed remediations — opening a pull request, paging on-call, flipping a feature flag — are classed high risk, and by default each one needs its own approval, which its proposer cannot give. A named person can issue a capability grant that pre-approves one kind of low-risk action for one investigation, for at most 24 hours and revocable at any time. Higher-risk remediations always need a per-action approval, and irreversible production actions always need a second approver. Every consequential action waits for a named person: anything above read-only in production, and every high-risk or irreversible action anywhere. Read-only actions and low-risk actions outside production run automatically, and those that deliver a report (Slack posts, Jira and PR comments) go only to destinations the organisation has approved. Routine alerting is not a remediation: it runs automatically on new incidents, and turning the production monitor off stops it. | BetaReviewed |
| Connector access | Minimum credential scopes are agreed per connector before an evidence source is connected. Read-only is the default posture. | Customer decisionReviewed |
| Encryption | No approved public encryption or key-management commitment is published. | Not yet publishedReviewed |
| Retention and deletion | No approved default retention, backup, deletion, or residency policy is published. | Not yet publishedReviewed |
| Model and provider | On the hosted service we choose and configure the AI provider; the customer does not choose it. On self-hosted and on-premises installs, you configure your own provider. | Hosted: ours. Self-hosted: yours.Reviewed |
| Subprocessor register | A formal public register and notification process are not yet published. | PlannedReviewed |
| RBAC and provisioning | Roles carry scoped permissions enforced on every request, and SAML and OIDC single sign-on and SCIM user provisioning are available to closed-beta teams. Group provisioning and role sync from your directory remain roadmap work: SCIM keeps the roster, and role grants stay an administrator action. | BetaReviewed |
| Audit export | Audited actions export as CSV or JSON on demand. Continuous streaming to Splunk, Datadog or your own webhook in OCSF 1.3 is limited to self-hosted Enterprise deployments, where it is switched on per deployment; it is not offered on the hosted service. A scheduled archival compliance feed remains roadmap work. | BetaReviewed |
| Self-host and customer VPC | A Helm install of the same runtime runs inside your own infrastructure, available in closed beta. A free signup issues your install credential. | BetaReviewed |
| On-premises | An on-premises install pins workloads to a region you choose and imports models offline, with a nightly restore drill measuring recovery against a published budget. Available in closed beta. | BetaReviewed |
| Air-gapped | An air-gapped install from a signed bundle is available in closed beta: the API services, runtime worker and schema setup install and run with no outbound traffic. | BetaReviewed |
| Air-gapped, still planned | An air-gapped web console, offline backups, local-model support, packaged upgrades and support commitments remain roadmap work. | PlannedReviewed |
Self-hosting via Helm
The same runtime installs into your own Kubernetes cluster with a Helm chart, so evidence never leaves your infrastructure.
It is available in closed beta.
The images are not public: a free Community signup issues the install credential the install pulls them with.
An air-gapped install from a signed bundle is also available in closed beta: the API services, runtime worker and schema setup run with no outbound traffic.
The air-gapped web console, offline backups, local models, packaged upgrades and support commitments are still planned.
We run the same runtime. The evidence contract, the citations and the approval gate do not change with the hosting choice.
Workloads pinned to a region you choose, models imported offline, nightly restore drill against a published budget.
Installs from a signed bundle with no outbound traffic: the API services, runtime worker and schema setup.
Web console, offline backups, local models, packaged upgrades and support commitmentsPlanned
Questionnaire pack
Reusable answers for a prospect security review. This is current hosted-beta practice, not a certification we hold and not a signed processing agreement.
| Topic | What we can say today |
|---|---|
| Architecture | Hosted closed beta (Vercel + Supabase + GCP GKE) or the same runtime self-hosted via Helm (available in closed beta). An air-gapped install from a signed bundle is in closed beta; its web console, offline backups and upgrades are planned. |
| Data flows | Approved signal in, cited report out. Remediations stop at a human. |
| Hosted-beta operators | Vercel, Supabase, Google Cloud, GitHub, and the LLM provider we configure for the hosted service. This is not a formal subprocessor register. |
| Retention | No published default retention, backup, deletion, or residency policy. |
Bring your security review before the pilot
We would rather answer the hard questions first than discover them in week six.