SECURITY STATUS
Our Trust Policy says we will communicate security incidents in plain English. This page is where that happens. Every incident we publish appears here with its severity, timeline, impact, and resolution.
GuardBotAI has not published a security incident. This is a live record, not a claim: when an incident is published it appears here automatically, and the absence of entries means none has been published rather than that none could ever occur.
Each claim below describes a control that exists in the running product. We do not list certifications we have not obtained or test results we have not produced.
Creating or revoking a gateway key, changing enforcement mode, engaging containment, and registering or revoking a sensor each write a permanent record with the actor and timestamp. These records cannot be edited or deleted from the application, and account members can read their own.
Every gateway decision is written to a chained record: each entry carries a hash of the decision and the hash of the record before it, so a removed or altered record breaks the chain.
If the policy engine, the key check, or the record write fails, the request is refused rather than forwarded. Containment refuses every request for a project until it is released.
Event records hold a hash of the request and, where a policy requires it, a redacted excerpt. Credentials are never written to event records and never forwarded in a blocked decision.
Every table enforces row-level access scoped to organisation membership, and the gateway derives the organisation from the presented key rather than from anything the caller sends.
The contact and enterprise quote forms verify a Cloudflare Turnstile token server-side, apply per-IP and per-email rate limits, and include a honeypot field.
To report a vulnerability, email security@guardbotai.com. Read our Trust Policy for the commitments behind this page.