Security Posture

Every security claim
is independently verifiable.

We document what is complete and what is in progress. Transparency is the posture. If you are in enterprise procurement and need something not listed here, ask us directly.

Appropriate for enterprise-adjacent pilot deployments
ProjectLedger runs on ProjectLedger

We run ProjectLedger on ProjectLedger.

Every internal deployment, security test, and engineering decision we run through our own evaluation pipeline. The artifacts are independently reviewable by any client or prospect on request. We do not ask you to trust our claims. We give you the record.

Our own
Infrastructure evaluated by ProjectLedger
Every test
Internal security run produces a sealed artifact
On request
Artifacts available to clients and prospects
10
Total security controls documented
8
Controls fully complete
2
Controls prioritized
0
Known critical security gaps
Security Architecture

Four pillars. Each one enforced by code, not policy.

Security documentation that says "we follow best practices" is not security. Every control listed here is enforced at the infrastructure or code level. Not by process. Not by policy. By the system itself.

01
Isolation
Tenant data is separated through shards. Logical isolation ensures your data cannot reach another tenant's environment by design, not by access control.
Shard-based tenant separation. Physical isolation (dedicated Firestore, Cloud Run, KMS per tenant) is available for enterprise deployments at additional cost.
02
Integrity
Every decision record is hashed with SHA-256 at the moment of write. The artifact is signed using Google Cloud KMS asymmetric signing. Any modification to any record breaks the hash chain. Any modification to the artifact breaks the signature.
SHA-256 per entry. KMS asymmetric artifact signing. The private signing key is non-exportable and remains inside Google Cloud KMS at all times. Verification requires only the public key and the key version reference included in every artifact. No connection to our systems required.
03
Enforcement
The ledger is append-only. Once a decision is recorded it cannot be modified or deleted. close_evaluation() hard-closes the window at the code level. Any promote() call after close returns HTTP 409. This is not a policy. It is a code constraint.
Append-only Firestore rules. HTTP 409 enforced in application layer. Two-layer enforcement: database rules plus application logic.
04
Failure Mode
The system is fail-closed in production. If the ledger cannot write a record, the calling system receives an error. Decisions do not proceed silently without being recorded. There is no silent failure mode that lets unrecorded decisions pass through.
Synchronous write confirmation required. No fire-and-forget recording. Error surfaces to caller on any write failure.
Control Status

What is complete. What is in progress. No ambiguity.

We do not list aspirational controls as complete. If it is in progress, it says in progress. If it is not started, it is not on this list.

ControlDescriptionStatus
Tenant separationShard-based isolation. Logical separation of tenant data. Physical isolation (dedicated infra per tenant) available for enterprise at additional cost.Complete
Asymmetric KMS signingKMS asymmetric artifact signing. Private key non-exportable, managed entirely within Google Cloud KMS. Key version reference included in every artifact for offline verification.Complete
Append-only enforcementTwo-layer enforcement: Firestore rules plus application layer. HTTP 409 on post-close writes.Complete
Fail-closed productionWrite failures surface to caller. No silent unrecorded decisions.Complete
API key hashing at restAPI keys are hashed before storage. Raw keys are never persisted.Complete
CI security scanningAutomated security scanning on every commit via CI pipeline.Complete
Rate limitingPer-tenant rate limiting on all API endpoints.Complete
Load testingProduction load tested. Results available on request.Complete
Third-party penetration testIndependent security audit by external firm. Scheduled prior to enterprise deployment.Prioritized
SOC 2 Type IIFull audit cycle planned. Targeted for active enterprise deployments.Prioritized
Independent Verification

You do not need access to our systems to verify an artifact.

Every artifact we produce is signed using Google Cloud KMS asymmetric signing. The private key is non-exportable and remains inside KMS at all times. To verify the signature, you need only the public key; the artifact includes the key version reference needed to identify the signing key. No API access. No credentials. No trust in our infrastructure required.

This is what makes the artifact meaningful in a legal or regulatory context. The record does not depend on our word. It depends on the math.

Any modification to any entry in the artifact breaks the SHA-256 chain. Any modification to the artifact itself breaks the KMS signature. Both failures are detectable without our involvement.

verify-artifact.sh
# Verify a ProjectLedger artifact
# No API access required.
# Public key only.

# 1. Download the artifact
curl -o artifact.json \
  https://ledger.projectledger.io/artifact/6VOIW4G

# 2. Extract the signature
cat artifact.json | jq -r .signature \
  | base64 -d > signature.bin

# 3. Extract the signed payload
cat artifact.json | jq -r .payload \
  > payload.json

# 4. Verify with public key
openssl dgst -sha256 -verify \
  projectledger-public.pem \
  -signature signature.bin \
  payload.json

# Verified OK
What We Claim

We are specific about what ProjectLedger does and does not prove.

Overclaiming security is a form of deception. The artifact proves specific things. It does not prove everything. Any vendor who claims otherwise is lying to you.

The list on the right is what you can take to a regulator, a legal team, or an auditor and stand behind. The list of what we do not claim is just as important.

Proves a decision was recorded at a specific time by a specific actor with a specific authority mode
Proves the record has not been modified since it was written
Proves whether a human was in the loop at the moment of commitment
Proves the artifact is independently verifiable without access to our systems
Does not prove the decision was correct or that the AI model behaved as intended
Does not prove compliance with any specific regulation. Provides the evidence infrastructure that supports compliance.
Does not prevent bad decisions. Records them so they can be reviewed, disputed, and learned from.
Enterprise Procurement

Security questions? Ask us directly.

If you are in procurement and need something not covered here: a specific control, a questionnaire, or a call with our engineering team, reach out. We will answer directly and in writing.

Contact Security Team