How we earn trust: by showing our work.
Our compliance posture, privacy rules and security architecture, summarised from the engineering specifications and the code — including the parts that are not finished.
The controls that matter, and their state today
Files, browsing, keystrokes and screen are never sent. Redaction happens before anything is queued.
Enforced in the application layer and tested in CI. Database row security is ready but not yet active.
Ed25519 manifests checked by the Linux, macOS and Windows agents, with two recorded deviations.
Administrative actions, commands, approvals and account changes are recorded and readable per organisation.
Six fixed roles with named permissions, decided from stored records, never from the request.
Off by default on consumer devices, enforced on the device and again by the server.
None held. We say so rather than show a badge.
One region, one host. Regional tenants are designed, not built.
Where trust begins and ends
Our specifications name nine trust boundaries. Each one has rules about what may cross it, and each refuses, records and never partially applies when a rule is broken.
| # | Boundary | Trust | State today | |
|---|---|---|---|---|
| B1 | Operating-system sensor | Trusted | A bridge exists; no native Windows sensor service runs yet. | Not released |
| B2 | Local protection service | Trusted | Detection, policy, storage and quarantine run locally (desktop is an unsigned pre-release). | Not released |
| B3 | App interface | Untrusted | Sandboxed; may only call 11 whitelisted handlers. | Not released |
| B4 | Interface ↔ service channel | Narrow, typed | Each handler validates its own input; paths are containment-checked. | Not released |
| B5 | Outbound queue on disk | Untrusted at rest | Bounded, re-validated before sending, carries telemetry only. | Not released |
| B6 | Cloud gateway | Untrusted network | TLS; device token in a header; identity stamped by the server. | Available |
| B7 | Tenant | Per tenant | Enforced in the application layer; PostgreSQL row security enforced; the application role cannot bypass it. | Limited |
| B8 | Enterprise admin plane | Higher privilege | Not built (mTLS device identity designed). | Coming |
| B9 | Region | Residency constraint | Not built. One region, one host. | Coming |
OS sensor (B1)
→ normalise → bounded local queue
→ deterministic detection
→ policy safety gate
→ local store (B2)
→ typed channel (B4) → app interface (B3, untrusted)detection → hub client
→ path redaction (on the device)
→ disk queue (B5, untrusted at rest)
→ consent re-checked at send time
→ TLS (B6) → cloud ingest → XDR timelineBoth paths work when the other is unavailable. Local protection never depends on our cloud being reachable.
Three parts of the trust center
SOC 2, ISO 27001, GDPR and DPDP readiness, residency, penetration testing — and the engineering controls we run instead.
Four data classes, consent, retention as actually configured, and every third-party service the code calls.
Identity, tenant isolation, roles, audit, encryption and signing, the known gaps, and how to report a vulnerability.
- The Windows agent has been verified on one Windows Server only; Linux is the best-tested build.
- A legacy plaintext push path from the hub to agents exists behind a switch that is off; it is scheduled for removal on 31 October 2026.
- The update root key is held on the hub, not offline, and signs manifests directly (owner-approved deviation).
- Legacy MD5-checked agent updates are accepted on the internal channel until 15 October 2026.
- Consumer device tokens do not rotate yet.
- Hub security events are not yet automatically pruned.
- Off-site backup and restore checks must continue; a saved dump alone does not prove recovery.
- Desktop downloads are unsigned pre-releases; signed production installers and wider platform checks remain pending.