SECURITY POSTURE
The system holding the evidence, secured at every layer
Protect decision evidence with encryption, access control, and residency choices.
SSE-KMS
Pending PII and DLQ storage
TLS
Terminated at deployment ingress
SAML + OIDC
Enterprise SSO
Object Lock
Governance mode by default
Encryption and data protection
Sealed before it travels, encrypted where it lands
Encrypted storage paths
AWS deployment paths use encrypted S3 storage; sensitive pending-PII and DLQ objects are protected with SSE-KMS and deny-unencrypted bucket policy.
TLS at the deployment boundary
Terminate production HTTPS at your load balancer, ingress controller, or reverse proxy because ingest must not be exposed directly.
Dual-layer signing
Each emitted SDK or signed gateway event carries a client-chain signature; ingest verifies and countersigns accepted records with a separate server key.
Configurable captured content
Every event carries content hashes while captured values follow the configured storage and PII policy, including intentional preservation in detect-only mode.
Access and residency
Your identity provider, your perimeter
SSO: SAML and OIDC
Google SSO plus enterprise SAML and OIDC through your existing identity provider.
Role-based access
Least-privilege RBAC with separate roles for developers, auditors, and admins.
Scoped API keys
Keys scoped to projects and environments, with rotation support.
In-VPC data plane
Run ingest, PII scanning, countersigning, the Merkle ledger, and evidence packs in your AWS account through the customer-VPC Helm or Compose deployment.