Trust Center

Security & Trust

GovernLayer is built to protect the systems that protect your AI. Security is not a feature we added — it is the foundation everything else is built on.

SOC 2 Compliant Infrastructure TLS 1.2+ Everywhere SHA-256 Hash-Chained Ledger
Infrastructure

Infrastructure Security

GovernLayer runs on hardened, enterprise-grade infrastructure with security controls at every layer of the stack.

SOC 2 Type II Compliant Hosting

Hosted on Railway, which maintains SOC 2 Type II compliance. Infrastructure is managed with continuous monitoring, encrypted storage, and strict access controls. All compute runs in isolated containers with no shared tenancy.

Encryption at Rest

PostgreSQL database storage is encrypted at rest using AES-256. All sensitive fields including password hashes, API keys, and audit records are protected at the storage layer. Backups are encrypted with the same standard.

TLS 1.2+ for All Connections

Every connection to GovernLayer — API requests, database connections, and inter-service communication — is encrypted with TLS 1.2 or higher. HSTS is enforced with a two-year max-age and preload directive.

No Customer Data in Logs

Structured logging captures operational metadata (request paths, latency, status codes) but never logs request bodies, API keys, tokens, or any customer-submitted data. Log output is sanitized before persistence.

Application

Application Security

Defense-in-depth controls built into the application layer, from cryptographic audit trails to fine-grained access control.

SHA-256 Hash-Chained Audit Ledger

Every governance decision is recorded on an immutable, hash-chained audit ledger. Each record contains the SHA-256 hash of the previous record, making any tampering mathematically detectable. The genesis hash is deterministic and verifiable.

bcrypt Password Hashing

All user passwords are hashed using bcrypt with per-user salt and an adaptive cost factor. Plaintext passwords are never stored, logged, or transmitted. Password verification occurs server-side only.

JWT Authentication with Expiration

Authentication uses JSON Web Tokens with configurable expiration. Tokens are signed with a 64-byte secret key and validated on every request. Expired tokens are rejected without exception.

Scoped API Key Authentication

API keys follow the format gl_xxxxx and support fine-grained permission scopes (govern, audit, risk, scan). Keys can be rotated, revoked, and audited per organization. Dual auth supports both API keys and JWT.

Redis-Backed Rate Limiting

Per-plan rate limiting enforced at the middleware layer using Redis as the backing store. Limits are applied per API key and per organization: Free (20 rpm), Starter (100 rpm), Pro (500 rpm), Enterprise (2,000 rpm).

OWASP Top 10 Mitigations

The application is built with OWASP Top 10 mitigations including parameterized database queries (SQL injection), input validation on all endpoints (XSS), CSRF protection via token-based auth, and strict Content-Security-Policy headers.

Headers

Security Headers

Every HTTP response from GovernLayer includes the following security headers, enforced at the middleware layer.

# Applied to every response via SecurityHeadersMiddleware Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=() Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'
Privacy

Data Privacy

Your data stays yours. GovernLayer provides deployment options and data handling practices designed for the most privacy-sensitive environments.

  • Local inference option. Deploy with Ollama for fully on-premises LLM inference. AI governance decisions can be made entirely within your infrastructure — no data leaves your network.
  • No training on customer data. GovernLayer never uses customer data, audit records, or governance decisions to train models. Your data is used solely to deliver the service you requested.
  • GDPR-ready data handling. Data processing follows GDPR principles: purpose limitation, data minimization, and storage limitation. We collect only what is necessary for governance operations.
  • Data deletion on request. Organizations can request complete deletion of all their data, including audit records, API keys, usage history, and account information. Deletion is permanent and irreversible.
Compliance

Compliance Frameworks We Follow

GovernLayer aligns its own security practices with the same frameworks we help our customers meet.

SOC 2

Infrastructure hosted on SOC 2 Type II certified providers. Internal controls aligned to Trust Services Criteria. Pursuing formal SOC 2 Type II certification.

Pursuing Certification

ISO 27001

Information security management practices aligned to ISO 27001 Annex A controls. Risk assessment, access control, and incident management follow the standard.

Aligned Practices

GDPR

Data processing compliant with GDPR principles. Purpose limitation, data minimization, right to erasure, and data processing records maintained for all customer data.

Compliant
CI/CD

CI/CD Security

Security is automated into every stage of our development and deployment pipeline. No code ships without passing these checks.

GitHub Actions CI

Automated continuous integration on every push and pull request. Linting and full test suite must pass before merge.

pip-audit

Dependency vulnerability scanning using pip-audit. Known CVEs in Python packages are flagged and blocked before deployment.

Bandit SAST

Static Application Security Testing via Bandit. Python source code is analyzed for common security issues including hardcoded secrets and injection flaws.

SBOM Generation

Software Bill of Materials generated in CycloneDX format. Full dependency tree documented for supply chain transparency.

Reporting

Vulnerability Disclosure

We take security reports seriously. If you discover a vulnerability, we want to hear from you.

Responsible Disclosure Policy

If you believe you have found a security vulnerability in GovernLayer, please report it to us responsibly. We ask that you give us reasonable time to investigate and address the issue before any public disclosure. We will not take legal action against researchers who follow this policy.

Please include a description of the vulnerability, steps to reproduce, and any relevant proof-of-concept. We will acknowledge receipt within 48 hours and provide an initial assessment within 5 business days.

Report vulnerabilities to: