No agent holds implicit access to any system. Every action is evaluated against policy before it reaches a system of record.
enforcedCompany / Trust
What a security review gets, in writing.
The questions a security review asks first, answered on a page rather than in a questionnaire round-trip. Where a control is configuration-dependent or not yet measured, it says so.
Fail-closed by contract No model in the governance path Deployable in your environment
SECURITY PRINCIPLES
Three properties the architecture holds.
These are structural, not configurable. They are the reason the rest of this page can be read at face value.
Any transport error, timeout, non-2xx or unparseable response resolves to deny, never to allow. Enforcement does not degrade quietly.
by contractThe policy engine is deterministic — YAML and OPA/Rego. No probabilistic decision, and no model drift, inside the governance layer.
enforcedDATA HANDLING
What is logged, and what is not.
The distinction that determines whether governance logs are themselves a data-protection problem.
Structured governance events: agent ID, session ID, tool name, policy decision, timestamp, latency. Designed to be read by an auditor.
enforcedNo raw prompts. No model outputs. No customer PII in governance logs. GovernorAI records the decision, not the conversation.
enforcedSelf-hosted deployments keep all data inside your environment. Hosted deployments support region selection.
per deploymentAES-256-GCM for credentials at rest, with a production guard that refuses to start without a persistent key. TLS 1.2 or higher in transit. Mutual TLS is available as a configuration option for the external policy-engine connection — not a blanket property of internal traffic.
aes-256-gcm · tls 1.2 floorRow-level isolation with per-tenant scoping, verified by an isolation inspector rather than asserted.
enforcedGovernance events are retained in the evidence ledger for the period the plan enforces — 7 days on Free, 30 on Startup, 90 on Pro, 180 on Team. The cap is a plan entitlement rather than a deployment setting.
DEPLOYMENT
Your security requirements decide the shape.
Managed GovernorAI infrastructure. We operate, scale and update it; you configure policy and govern your agents.
per deploymentGovernorAI runs entirely in your infrastructure. No governance data leaves your environment.
per deploymentA bundle exists for sites that cannot reach a control plane at all.
per deploymentThe SDK is a thin client. You keep every credential, all tool code and all control flow. GovernorAI is not a proxy in front of your model provider.
no token pathACCESS & IDENTITY
Who can change a policy, and how that is proved.
Role-based access control, SSO and SCIM provisioning, with separation of duties on policy approval.
rbac · sso · scimOAuth2/OIDC against your existing identity provider. No shared secrets.
enforcedEd25519/Merkle signed evidence bundles are available per deployment, and are not default-on. Configuration and verification are explicit.
configureProcess
- Acknowledgement of a reported security issue
- Initial assessment and triage
- Coordinated disclosure for confirmed vulnerabilities
- Post-incident reporting to affected customers
We acknowledge a reported security issue within 24 hours, and complete initial assessment and triage within 72 hours. Both are measured from receipt at security@sentinellayer.dev. Coordinated disclosure timing for a confirmed vulnerability is agreed with the reporter, since it depends on the fix.
Safe harbour
We authorise good-faith security testing against GovernorAI-owned systems and designated staging environments, where testing avoids service degradation, data access beyond the tester’s own account, social engineering, denial-of-service, physical attacks, spam, and testing of third-party systems.
Stop and report promptly on encountering personal data, credentials or customer data. We will not pursue legal action for authorised good-faith testing that follows this policy. Reports go to security@sentinellayer.dev.
COMPLIANCE POSTURE
Controls that map, not certifications we hold.
GovernorAI produces controls and evidence that map to SOC 2 Trust Services Criteria, GDPR, HIPAA safeguards and EU AI Act obligations for high-risk systems. Mapping evidence to a control is not the same as holding a certification against it.
Intellectual property
Two U.S. provisional applications are on file.
Honesty note
This page describes architecture and configuration, not an audit opinion. GovernorAI holds no certification on your behalf and issues none — a certification is granted by an auditor or certification body against their own assessment. What is offered here is a record an assessor can examine, and a boundary stated plainly enough to be checked. Every marker above is an unsourced operational commitment, not a decided one.