Security
Security posture and responsible disclosure.
Detailed architecture documentation is available to early access participants.
VPC-first deployment
Runs inside customer environments that require strong boundaries and minimal external dependencies. No required SaaS control plane.
Your keys, your signatures
All signatures (approvals, Evidence Binders) use ECDSA P-256 keys that you control.
Fail-closed behavior
If identity, policy, or approvals can't be validated, the request is blocked. There is no best-effort mode.
Architecture
What you control.
Customer-controlled
- Signing keys (ECDSA P-256)
- Policy bundles (OPA/Rego)
- Deployment infrastructure (your VPC)
- Evidence storage and retention
- Approval routing and channels
- Network configuration and egress rules
- Certificate authority and mTLS configuration
Vendor-provided
- Software binaries and updates
- Documentation and support
Security contact
For vulnerability reports or security questions:
Please include: affected endpoint or component, steps to reproduce, and impact assessment. We will acknowledge receipt within 2 business days.
Responsible disclosure
We welcome responsible disclosure. Guidelines:
- Do not access data beyond what is required to demonstrate the issue
- Avoid actions that could degrade service availability
- Do not disclose findings publicly until we have had reasonable time to address them
- If you're unsure whether a test is safe, email first