Help and support
Help by role, how to verify a pack yourself, and how to reach us. Every capability here is by design; GovernanceOS is a prototype.
Step by step
Guides
Sign up with your work email, request your access code, and start the 7-day trial when you enter the access code.
Claim your institution’s tenant
An administrator signs in with the institution’s identity provider, names the register owner and claims the tenant.
Read the gate record and its evidence, then sign, return or reject it with a reason, as the named approver.
Download the verifier and the pack, check their SHA-256, run it with --key and the pack key hash you were sent, and read the result.
Check that an email came from us
Every email from GovernanceOS carries a check code. Look it up yourself before you trust the email.
Start here
Help for your role
Institution administrator
Claim the tenant, set the regime profile, invite members, choose which assistants may read.
CRO
Read the Control Center, sign a gate with a reason, decide on a vendor change.
Model owner
Register a system, attach evidence, prepare G1 and answer a condition.
Validator
Record the G2 report, findings and dissent, independent of the approver.
Compliance lead
Build an evidence pack with adverse records included, and issue an examiner key.
Practitioner
Sign up, import a register, bring files, draft findings, hand over to the client.
Examiner
Open a key, ask a question, see how it was read, verify a pack offline.
For examiners and internal audit
Verify a pack yourself
The verifier runs offline with Python 3 and nothing else installed. Try it on the sample pack for a fictional institution, then on its tampered twin to see a failure.
- gos-verify.py, the verifier, Apache 2.0
- nebula-mutual-2026Q3.pack.json, the sample pack
- nebula-mutual-2026Q3-tampered.pack.json, changed after signing
- SHA256SUMS.txt, to check the files before you run them
python gos-verify.py nebula-mutual-2026Q3.pack.json --expect 2bb3a4f271d74a906c1a507a918313f67a3ca88bd2c2edc84b4b5a4a853bcf9f
Sent the pack key hash instead of the head? Use --key with it. Exit codes: 0 verified, 1 intact but not pinned (run it again with a value you were sent), 2 chain broken, 3 signature invalid, 4 head differs from the one you were sent, 5 the file cannot be read, 6 signed by a key other than the one you were sent. A pass proves the records were not changed after they were chained and signed. It does not prove they were true when written.
Check that an email came from us
Every email from GovernanceOS shows a shield beside the logo, with a check code. A picture can be copied, so the code is the proof: we keep a record of every code we send.
- Do not use the email’s links to check it. Type governanceos.si in your browser yourself.
- With an account: sign in and open Account, then Emails we sent you. The code must be listed.
- Without an account: type governanceos.si/check, or use the form below. We answer only yes or no.
- Not listed? The email is not from us. Do not open its links or attachments; tell us through the support form on this page.
We never ask you to send us a password or a code, by email, phone or chat. By design, mail from us is signed so your provider can tell it apart from imitations.
Support
How to reach us, and what to expect
Support by plan
| Plan | How to reach us | Response | Access to your records |
|---|---|---|---|
| Register (free) | This form and the help pages | No response-time commitment | None. Support never sees your register. |
| Practitioner | This form, from inside your account | Within two business days | Only with your written permission, for the case, and recorded. |
| GovernanceOS Cloud | This form and a named contact | By severity, below; targets set at the first contract | Sealed. Your administrator approves time-boxed, scoped access; it is written to your chain. |
| GovernanceOS VPC | As Cloud; you run the platform in your own cloud account | By severity, below; targets set at the first contract | None. We have no access to your account; you share logs you choose. |
Severity, for institutions
| Level | What it means | First response |
|---|---|---|
| S1 | Records cannot be read or exported, or no one can sign any gate. | Set in the contract |
| S2 | One role cannot sign, or declarations from a boundary stop arriving. | Set in the contract |
| S3 | A screen, export or row is wrong, and there is a workaround. | Set in the contract |
| S4 | A question, a request, or a suggestion. | Set in the contract |
Response targets are set in your contract and published here when the first contract is signed. Reads and exports of your records never depend on support.
Service health: Status. Barriers to access: Accessibility.