Security
Built to be checked, not trusted.
A gate that holds your riskiest actions has to earn its place on the path. So it is designed to keep as little as it can, fail safe when it can't decide, and leave a record anyone can check without asking us.
What a receipt keeps
Fingerprints, not your data.
The Gate has to see an action to classify it. The receipt it signs is designed to keep only what a reviewer or a claim needs to check.
Example requestExample
- prompt
- Refund Jane Example $4,800 for the late order.
- tool
- payments.refund
- target
- POST payments.example /v1/refunds
- body
- {"amount":480000,"currency":"usd","note":"late order"}
- customer
- Jane Example
- amount
- $4,800
- approver
- on-call lead
ReceiptDraft format
- class
- waiting
- rule
- waiting
- decision
- waiting
- tool
- waiting
- target
- waiting
- customer
- waiting
- amount
- waiting
- approver
- waiting
receipt sha-256not signed yet
Not signed yetKept
- Salted hashesOf the target, the tool, the response and the approver. They prove a match without saying what was matched.
- BandsHow much was at stake, as a range, not the exact amount.
- IdentifiersThe action class, the rule and its version, the decision, the model version that answered.
Designed never to keep
- PromptsWhat you asked the machine stays with you.
- Request bodiesThe content of the call is not copied into the record.
- NamesYour company and the people in it appear as salted hashes.
When things go wrong
When in doubt, it holds.
A safety gate that waves things through when it is confused is worse than none. When it can't read an action, or when it is down, the Gate is designed to fail toward holding.
- Can't read it, hold itAn action the Gate can't parse waits for a person. Unreadable means held.
- Gate down, no key, no actionWith the key broker the machine never holds the real key, so a Gate that is down means nothing irreversible runs. Lighter tiers are designed to hold too, and each receipt is designed to say which tier was used.
- A model can only add cautionA risk score may add a hold. It can never remove one.
- We are a shared risk tooOne gate in front of many teams is a single point of failure, and we are designing for it as one.
Standards
Designed for open formats.
The record is designed for published IETF standards, so anyone will be able to check a receipt with their own tools. The demos on this site use a simpler JSON draft, signed in your tab.
IETF RFC 9943
The signed statement
Each receipt is designed to be a SCITT signed statement, "identifiable and non-repudiable".identifiable and non-repudiable Statement about an Artifact signed by an Issuer
IETF, RFC 9943 (SCITT architecture) Read the source
IETF RFC 9942
The proof of place
A COSE receipt proves the statement's place in the log.prove properties of a Verifiable Data Structure
IETF, RFC 9942 (COSE receipts) Read the source
Append only log
The record
A log designed to only grow, with its fingerprint planned to be countersigned by outside witnesses.
How we will run it
The controls we hold ourselves to.
These are design commitments for the Gate as it is built, and we label them that way.
- Signing keysThe log's keys kept in a hardware security module, and rotated.Planned
- Tenants apartEach team's records isolated from every other team's.Planned
- Detail stays with youRaw detail encrypted in your own tenant, disclosed only for a claim.Planned
- Our own auditOur own SOC 2 report, and our own tech errors and omissions cover.Planned
This website
We practise it here first.
Every demo on this site runs in your browser. The only things that leave it are a page view count (the page, a campaign tag and the referring site; your address is never stored) and the form, when you choose to send it.
- No cookies, no trackersNo analytics, no ads, and no request to any other site. Every file comes from this one.
- We don't keep your IP addressVisits are counted once per page per network per day with a one way key, deleted at the first visit to a main page, or sign-up, after that day.
- A strict content policyThe browser is told to run only this site's own scripts and styles, and to refuse anything injected.
- Throwaway keysDemo receipts are signed with a key made in your tab and gone when you close it.