Fail-closed by construction
The invariants, isolation model, and data-minimization rules the DecisionHypervisor runtime is built on.
Core invariants
Deny precedence
When any applicable rule denies, the decision is denied. Allow rules can never override a deny. This is asserted by the engine's test suite, not by convention.
Fail-closed enforcement
If policy cannot be evaluated, context is missing, or the runtime cannot start safely, the default outcome is denial. Production nodes refuse to boot without their bootstrap credentials.
Deterministic evaluation
Identical inputs produce identical decisions. There is no probabilistic component anywhere in the enforcement path — models propose, but they never decide.
Enforcement controls
Tenant and environment scoping is enforced by PostgreSQL RLS on every transaction. Cross-tenant access fails at the database, not at a middleware check.
The API runs under a non-owner database role; schema migrations run under a separate owner role. Compromise of the service role does not grant schema control.
All request models reject unknown fields. The boundary does not guess at malformed or smuggled parameters — it refuses them.
Audit traces are SHA-256 hash-chained. Altering any historical decision record invalidates the chain — tampering is detectable, not merely logged.
We do not receive your customer passwords, medical files, or credentials.
DecisionHypervisor evaluates action metadata — structured claims about what an agent intends to do. Payment keys, protected health information, and connection strings remain inside your cloud boundary. Decisions are made on the shape and authority of the action, not on its sensitive payloads.
TLS 1.3
Encryption in transit on platform-managed API endpoints.
AES-256
Encryption at rest on managed storage volumes operated by the platform.
SOC 2 Type II
Control program under preparation; no independent audit is currently underway.
Tenant Isolation
Row-level scoping enforced by PostgreSQL RLS.
Scopedecisionhypervisor.com, its API endpoints, and the DecisionHypervisor runtime interfaces made available to design partners. Do not test third-party services, customer deployments, or physical infrastructure.
Safe harborWe will not pursue legal action against good-faith researchers who follow this policy, avoid data access beyond what is necessary to demonstrate the issue, and do not disrupt service for others.
Response targetsWe aim to acknowledge reports within two business days and to provide a remediation assessment or timeline within ten business days.
How to reportEmail security@decisionhypervisor.com with a description, reproduction steps, and potential impact. Please do not disclose the issue publicly until we have had a reasonable opportunity to respond.
Security inquiries and responsible disclosure are handled directly by our engineering team.
Contact security →