SECURITY POSTURE
The system holding the evidence, secured at every layer
Encryption, access control, and residency are architectural defaults rather than bolt-ons.
AES-256
At rest, KMS-managed
TLS 1.3
In transit, enforced
SAML + OIDC
Enterprise SSO
WORM
Immutable, configurable retention
Encryption and data protection
Sealed before it travels, encrypted where it lands
AES-256 at rest
Audit logs and payloads are encrypted with AES-256, with keys managed in AWS KMS and rotated automatically.
AWS KMS · automatic rotation
TLS 1.3 in transit
HTTPS with TLS 1.3 enforced end to end, and the SDK rejects plaintext endpoints outright.
no plaintext endpoints
Dual-layer signing
Every event is HMAC-signed at capture and countersigned by ingest, so no single side can forge a record.
client HMAC + server_sig
Hashed compliance record
The canonical record stores content hashes, never raw prompts, and raw content is an optional, access-restricted layer.
disable · redact · keep in your own S3
Access and residency
Your identity provider, your perimeter
SSO: SAML and OIDC
Google SSO plus enterprise SAML and OIDC through your existing identity provider.
your IdP, not ours
Role-based access
Least-privilege RBAC with separate roles for developers, auditors, and admins.
developer · auditor · admin
Scoped API keys
Keys scoped to projects and environments, with rotation support.
X-API-Key · per-project · per-env
In-VPC data plane
Run the entire pipeline inside your own AWS account, where prompts never leave your VPC and you hold the countersigning key.
only hashes, signatures, and verdicts sync out