Security and trust
Security, stated plainly.
SOC 2 Type 1: not started. Until it is attested, every institution runs VPC in its own cloud account. Per-tenant keys. An outbound-only gateway. Reads and exports never stop.
Every capability on this page is a design commitment, and every record shown is an example on a fictional institution.
Posture
Attestations, stated plainly.
| Attestation | Whose | State |
|---|---|---|
| SOC 2 Type 1 | GovernanceOS, by an independent auditor | Not started. The target quarter is set when the auditor is engaged. Until Type 1 is attested, every institution, in every jurisdiction, runs VPC in its own cloud account. |
| SOC 2 Type 2 | GovernanceOS, by an independent auditor | Observation window set with the auditor, after Type 1 |
| SOC 1 Type 2 | GovernanceOS, by an independent auditor | Not planned before SOC 2 Type 2 |
| ISO/IEC 27001 | GovernanceOS | Only on a named buyer's requirement |
| Framework conformance | Self-declared by GovernanceOS | Self-tests published per framework |
| Chain verifier | Open source, Apache 2.0 | Runs without us |
Hosting in 
Canada.
GovernanceOS Cloud runs in a Canadian region. Each tenant has its own key. The Boundary Gateway makes outbound connections only; there are no inbound firewall rules.
In VPC, everything runs in your own account and region.
Practitioner workspaces are hosted by GovernanceOS in Canada. With SOC 2 Type 1 not started, check that each client accepts a vendor-run workspace before you import its register.
Subprocessors: who else touches what.
Each is named before the part it serves opens.
- Delivery of this site: Vercel
- Analytics on the public site: Google Analytics 4
- Per-tenant keys and secrets: a managed secrets service, in Canada
- Public corpus search: named when it opens
- Sign-in codes and notices: named when sign-in opens
- Bot check on forms: Cloudflare Turnstile, when the forms open
Assistant vendors (Claude, ChatGPT, Copilot) are not our subprocessors. When your people connect an assistant, the record content they read goes to that vendor under your own agreement with it.
Testing, resilience and incidents.
Testing
Penetration test plan
An independent test before the first Cloud tenant, then yearly and on every major release. Summaries go to institutions under their terms.
Resilience
Recovery
Recovery time and recovery point as set in each institution's contract, backups in the same region, staff access to tenant data only when your administrator approves it, time-boxed and scoped, and written to your records.
Incidents
Notification
We notify an affected institution within the time its contract sets, after confirming an incident, with what we know and what we do not yet know.
Retention and exit: your records, your schedule.
Records are retained under object lock for the period your institution sets. Reads and exports never stop, for any reason.
On exit: a full export in both forms, your verification with the open verifier, written confirmation, then destruction of the per-tenant key. A deletion attestation is the last declaration in the chain.
The exit covenantReleases: signed, with a manifest of tools.
Example release record
- Release
- 2026.10.1
- Image signature
- verified
- Tool manifest hash
- e341b1a6038544333df4b42eaa95a76dd9c881cc89953020f43611791af984d1
- SBOM
- published with the release
Questions
Questions a security reviewer asks.
Where do records live?
GovernanceOS Cloud runs in a Canadian region. In VPC, everything runs in your own cloud account and region. Until SOC 2 Type 1 is attested, every institution, in every jurisdiction, runs VPC in its own cloud account.
Who holds the keys?
In Cloud, each tenant has its own key. In VPC, you hold the keys in your own key management service, with the region and the egress allow-list.
What leaves our boundary?
Proofs, never payloads. The Boundary Gateway makes outbound connections only; there are no inbound firewall rules.
Can GovernanceOS staff open our records?
Only when your institution's administrator approves it. Access is time-boxed and scoped, and written to your institution's records.
How do assistants connect, and what can they write?
Claude, Claude Code, ChatGPT and Microsoft Copilot connect over MCP. They read and draft. A gate passes only with the named approver's signed token, issued outside the chat. Bank tenants deny cloud assistants by default.
What happens to our records if we leave?
Reads and exports never stop, for any reason. You get a full export in both forms and verify it with the open verifier; then the per-tenant key is destroyed. The schemas stay licensed to you for your own records.
Bring your security reviewer.
Book thirty minutes on hosting, keys and attestations. Or read the exit covenant: seven commitments, written into the agreement.