database
operational100.00% · 78 checks · median 1565 ms
SECURITY STATUS
Security status and incident record
Our Trust Policy says we will communicate security incidents in plain English. This page is where that happens. Every incident we publish appears here with its severity, timeline, impact, and resolution.
Measured availability · last 30 days
last check 11/3/2026, 9:41:48 AM100.00%
Calculated from 156 automated checks of the services below, with 0 failed checks. Checks run automatically and are recorded permanently; this is a sampled measurement of our own components, not a contractual uptime commitment.
policy engine
operational100.00% · 78 checks · median 0 ms
Machine-readable: /api/public/health
No security incidents published
GuardBotAI has not published a security incident. This is a live record, not a claim: when an incident is published it appears here automatically, and the absence of entries means none has been published rather than that none could ever occur.
Controls in place today
Each claim below describes a control that exists in the running product. We do not list certifications we have not obtained or test results we have not produced.
Security-affecting actions are recorded
Creating or revoking a gateway key, changing enforcement mode, engaging containment, and registering or revoking a sensor each write a permanent record with the actor and timestamp. These records cannot be edited or deleted from the application, and account members can read their own.
Security decisions are tamper-evident
Every gateway decision is written to a chained record: each entry carries a hash of the decision and the hash of the record before it, so a removed or altered record breaks the chain.
The gateway fails closed
If the policy engine, the key check, or the record write fails, the request is refused rather than forwarded. Containment refuses every request for a project until it is released.
Raw prompts and secrets are not stored
Event records hold a hash of the request and, where a policy requires it, a redacted excerpt. Credentials are never written to event records and never forwarded in a blocked decision.
Accounts are isolated from one another
Every table enforces row-level access scoped to organisation membership, and the gateway derives the organisation from the presented key rather than from anything the caller sends.
Public forms are protected from bots
The contact and enterprise quote forms verify a Cloudflare Turnstile token server-side, apply per-IP and per-email rate limits, and include a honeypot field.
What we do not yet claim
- We hold no external security certification and claim none.
- No independent penetration test has been completed and published.
- The downloadable endpoint sensor is not yet released for installation.
To report a vulnerability, email security@guardbotai.com. Read our Trust Policy for the commitments behind this page.