A security product should be the one you can check
This page states what is true today, including the parts that are inconvenient. A platform that holds brokered privileged access to your entire estate has to be evaluated on evidence, not adjectives.
What we would tell you before you asked
Pending External penetration test
The estate plane carries brokered privileged access to your whole fleet. Its own module manifest sets external_pentest_required_before_production: true, and that test has not yet happened. We treat it as a release gate rather than a nice-to-have.
Pending Certifications
No SOC 2 or ISO certification is held today. The compliance module continuously collects the evidence those audits need — for you and for us — but evidence is not a certificate and we will not imply otherwise.
By default Enforcement is off
Segmentation enforcement ships in monitor-only mode. Programming a firewall, converging a cloud security group, applying a NetworkPolicy or broadcasting policy to a third-party enforcement point are all refused until an operator deliberately sets USCP_ENFORCEMENT_MODE=enforce. Rollback is never gated.
Stated per capability GA vs Beta
20 capabilities are GA; 84 are Beta — shipped with real logic and tests, pending pre-production hardening. The split is published in the product itself at /.well-known/api-capabilities, not just in marketing.
Not yet measured Scale envelope
No workload-count ceiling is quoted, because none has been measured on production-shaped hardware. The requirement is that the envelope is measured and published per deployment — an invented number would be exactly the kind of claim this page exists to avoid.
Verified Tenant isolation
Postgres row-level security is FORCE-enabled on every tenant table, and the runtime connects as a NOSUPERUSER / NOBYPASSRLS role so the database enforces isolation rather than application code remembering to. There is a CI test that proves it as that restricted role.
Properties, not policies
Things that are true because of how it is built, rather than because of a document saying they should be.
Operators never hold secrets
Credentials are stored as sealed envelopes and injected at connect time. There is no API that returns a secret in plaintext, and external PAM systems are dereferenced at injection rather than copied in.
Recording cannot be turned off
Every brokered privileged session is recorded and command-mediated, with a dangerous-command denylist and four-eyes on estate-wide actions. The highest-value target in this architecture is the platform itself, and it is built accordingly.
Blast radius is bounded
Estate-wide actions run staged — canary, then ring, then full — rate-limited per channel, with a global kill switch and per-target circuit breakers. A bad policy cannot brick the estate in one command.
Nothing fabricates data
Telemetry surfaces with no real source return an honest empty state, never plausible-looking synthetic rows. Sample data exists for demos and is always tagged synthetic: true. A posture score with no evidence reports unknown, not 100.
Egress is guarded by construction
Every outbound call the platform makes on your behalf goes through an SSRF guard: loopback, link-local and cloud-metadata addresses are unreachable, DNS is bounded, and resolved IPs are pinned so rebinding cannot slip past the check.
The supply chain is verifiable
Signed releases with SBOM, CBOM, VEX and SLSA provenance, plus a reproducible build: build it twice and the digests match. A CBOM deadline gate fails the release if a crypto primitive is past its deprecation date.
Your data, your region, your key
Region residency
Data stays in the region you pin. A sovereignty topology API reports exactly which regions hold what, so the answer to a residency question is a query rather than an email thread.
Customer lockbox
Vendor access to your data requires your approval, per request, with a default-deny on no response for restricted data. Approvals and denials are both audited.
Hold-your-own-key
With HYOK enabled, revoking your key grant renders your data undecryptable by us. That is a mechanism, not a promise — and the redaction proof-pack machinery is what demonstrates it.
Air-gap, fully
Every capability works with zero egress, including licensing via signed offline bundles. No telemetry, no credential and no estate data ever transits a vendor endpoint.
Vendor continuity
Source and key escrow with a continuity licence path: if the vendor disappears, the frozen build keeps serving licensed capabilities with anti-piracy lockout suspended and no phone-home.
Exit is a feature
Self-service export, portability and erasure are first-class functions. Consolidation should not become lock-in.
Technical due diligence
There is a binding specification behind all of this, a documented threat model with a CI gate that fails when a trust boundary lacks a mitigation, and per-incident runbooks. Ask and we will walk your team through the parts that matter to you.