Security posture.
Governance software has to hold itself to the standard it evaluates against. Here is how Astra Verdix protects tenant data, the ledger, and the integrity of every verdict it produces.
Encryption in transit & at rest
TLS for all client-server traffic. Data encrypted at rest by the underlying storage layer. Secrets are never stored in plaintext.
Tenant isolation by RLS
Every policy, proposal, evaluation, and ledger entry is gated by row-level security scoped to the calling tenant. Cross-tenant reads are a schema impossibility.
Reproducible verdicts
Canonical hashed inputs, deterministic gate pipeline, and append-only hash-chained ledger. Tampering with a historical record breaks the chain.
MFA & access controls
Email-based authentication for pre-alpha. Role-based access controls at the workspace layer. MFA and SSO paths reserved for GA.
Privacy by design
We collect only what is necessary to operate the platform. We do not train models on your tenant content. We do not sell personal information.
Backups & recovery
Automated backups of tenant data with point-in-time recovery windows aligned to the platform's retention policy.
Shared responsibility
MebuisWorks operates the Astra Verdix platform, its infrastructure, and its underlying security controls. Customers are responsible for authoring policies that reflect their compliance obligations, managing workspace membership, and integrating verdicts into their own risk process. Neither side can substitute for the other.
Pre-alpha status
Astra Verdix is in pre-alpha. Formal third-party certifications (SOC 2, ISO 27001, HIPAA BAAs, etc.) are on the GA roadmap and are not claimed today. We are happy to walk pilot customers through our current controls and roadmap on request.
Responsible disclosure
If you discover a security issue, please email security@mebuisworks.com before publishing. We acknowledge reports within 48 hours and work with reporters on a coordinated disclosure timeline. We do not pursue legal action against good-faith security research conducted within the scope of this policy.