Signed decision records
Every Decision Dossier is signed with Ed25519, and the public keys are published. You can verify any dossier offline, without an account and without calling us.
Trust Center · Execution Authority
The control story, in the open.
What can security teams verify?
Security teams can verify signed Decision Dossiers, inspect how execution grants bind approval to an action, and review Decionis’s published security controls. The Trust Center explains access, encryption, data location, private deployment and certification status. It also links to release evidence and failure behavior so reviewers can assess the boundary they plan to connect.
- Verify Ed25519 signatures against published keys.
- Review replay protection and execution grants.
- Check deployment and data-handling details.
- Read the current certification status below.
Control mappings and infrastructure-provider certifications do not certify Decionis. Status is stated separately for each framework.
Ed25519-signed Decision Dossiers · single-use execution grants
Running a security review? Start here.
- 1
Start with what you can check — Ed25519-signed Decision Dossiers that verify offline against the published keys, and single-use execution grants that are refused on a second claim. Audit status for each framework is further down this page.
- 2
Review the Governor Layer control design — who can change policy, who approves it, how it is enforced, and how a change is proven — each control with an honest status.
- 3
Walk the Governor Playbook — the operating lifecycle step by step, with the SOC 2 / ISO 27001 control each step produces evidence for.
- 4
Check the standards matrix — control-by-control mapping with evidence artifacts and auditor questions — alignment evidence, not a certification claim.
- 5
Verify a signed dossier yourself — generate a real Ed25519-signed Decision Dossier in the browser and verify it without an account.
- 6
Send us your questionnaire — vendor-assessment, DPA, or security-review questions we answer directly — before a diligence cycle, not after.
Security
Each statement names where you can check it. What happens when a surface cannot reach Decionis is on the failure-posture page.
Single-use execution grants
An approved action carries an execution grant bound to that exact action. The grant is claimed once, immediately before the action runs, so a replayed request is refused.
Identity and access
Role-based access control is live, and single sign-on supports OIDC and SAML. Every API key and session is scoped to one organization.
Encryption
Every public endpoint accepts TLS 1.2 or 1.3 only. Stored data is encrypted at rest with AES-256.
Private deployment
Run the Decionis Authority in your own cloud from the versioned Helm chart, under a commercial license.
Where your data is
The hosted service runs in one Microsoft Azure region, Central US. Regional data residency is planned.
Subprocessors
Our infrastructure providers hold ISO 27001 and SOC 2 Type II. Those certifications are theirs, not Decionis's. The full subprocessor list is available on request.
Data Processing Agreement
A DPA is available. Ask for it with your security questionnaire, and we answer both directly.
Report a vulnerability
Report a vulnerability privately to security@decionis.com. Leave production keys, customer payloads and unredacted dossier contents out of the report.
security@decionis.comdecionis.com/.well-known/security.txtdecionis.ai/.well-known/security.txt
Enterprise trust signals
Microsoft ISV Partner
Listed and reviewed inside the platforms your procurement and security teams already trust.
NVIDIA Inception
AI infrastructure ecosystem signal for technical diligence and category legitimacy.
AWS Activate
Amazon's startup program — cloud ecosystem alignment for governed execution.
Public docs and quickstart
Public API docs, an evidence index, a quickstart and working onboarding flows — so you can judge how deep the product goes before anyone books a call.
Security and governance materials
Public trust pages describe RBAC, SSO posture, deployment model, tradeoffs, and audit evidence instead of hiding the control story behind a sales process.
Signed Decision Dossiers
Every certified action can produce signed Decision Dossier proof that can link into a Decision Chain and Execution Ledger for regulator and reviewer workflows.
Policy snapshots and override evidence
Policy Snapshot, Override Dossier, Policy Drift, and saved-risk-value artifacts make exceptions, approvals, and prevented exposure inspectable.
Kill switches
Org-wide and per-decision kill switches give teams a visible rollback and restraint surface for high-stakes autonomous execution.
Audit and framework status
SOC 2
In progressSOC 2 formalization work is in progress. Controls are mapped publicly (change management, access, and monitoring) ahead of formal attestation.
GDPR
In progressGDPR formalization work is in progress.
ISO 27001
PlannedISO 27001 is planned. Relevant controls are already mapped in the standards matrix.
EU AI Act (Art. 12 logging)
MappedThe Decionis Score maps to EU AI Act articles including Art. 12 (record-keeping) and Art. 14 (human oversight). See the AI Act readiness page.
Regional data residency
PlannedRegional data residency is planned rather than broadly available by default today.
Open-source releases you can check
The projects that run at your boundary publish what went into each release, and a way to check it. AgentSafe holds the OpenSSF Best Practices badge. What is open and what the authority does is on the open-source page.
AgentSafe v0.3.5
- A CycloneDX SBOM and signed build provenance with the release
- SHA256SUMS for every release file
- A Sigstore-signed release tag
- SLSA provenance on its npm packages
- The OpenSSF Best Practices passing badge
Steward v0.3.0
- A CycloneDX SBOM and signed provenance with the release
- A container image you can check with gh attestation verify
Review the control design
Governance controls
Maker–checker policy approval, separation of duties, RBAC, SSO, and kill switches.
Governor Playbook
The lifecycle walkthrough for compliance officers — policy to enforcement to evidence, with SOC 2 / ISO mapping per step.
Compliance evidence pack
Governed decisions exported as control-mapped evidence for SOC 2, GDPR, and EU AI Act.
Failure posture
What every surface and connector does when it cannot reach Decionis, checked against the code, with the known gaps stated.
Security advisories
Every published advisory for Decionis and AgentSafe, the release that fixes it, and who reported it, with the findings ledger behind it.
Open source and the Decionis Authority
What runs at your boundary in the open, what the authority does, and where the line between them is.
Compliance standards matrix
SOC 2 and ISO 27001 controls mapped to concrete Decionis evidence.
EU AI Act readiness
The Decionis Score mapped to EU AI Act articles.
GRC integration
Feed signed evidence into Archer, OneTrust, or ServiceNow GRC.
Audit infrastructure
Ed25519-signed, tamper-evident Decision Dossiers.
Public dossier corpus
Signed synthetic dossiers with a DOI (10.5281/zenodo.22692903) and an open verifier, so the verification claim can be checked without an account.
Limits worth knowing: Decionis is not a full GRC suite, and regional data residency is planned rather than available by default. The audit status of each framework is listed above, exactly as it stands.
Evaluated outside the system it governs
Independent, in two specific senses.
Every adjacent tool is embedded in the stack it evaluates — a gateway watching its own traffic, an identity provider auditing its own tokens. The authority has to stand outside that, and the word has exactly two honest meanings.
The architectural claim
Independent of the system it governs
The policy is evaluated outside the application that proposed the action, so the check survives the failure of the thing it checks. A floor enforced inside the tool that moved the price is gone the moment that tool is what went wrong.
The evidential claim
Independently verifiable
The verdict can be re-derived from the dossier by someone who does not run Decionis. A signature proves a record was not altered afterwards; re-derivation proves the answer was the one the policy required.
The second claim is checkable without an account: a public corpus of signed dossiers and an open verifier let anyone confirm that the verifier refuses what it should, and a published key set lets anyone verify a real record. Check a Decision Dossier yourself.
Independent describes where the check runs and who can recompute it. It says nothing about the commercial relationship: Decionis is a paid vendor, enforces its customer’s own policy, and issues no opinion of its own.
Common questions
What is Decionis’s certification status?
SOC 2 formalization work is in progress. Controls are mapped publicly (change management, access, and monitoring) ahead of formal attestation. GDPR formalization work is in progress. ISO 27001 is planned. Relevant controls are already mapped in the standards matrix. The Decionis Score maps to EU AI Act articles including Art. 12 (record-keeping) and Art. 14 (human oversight). See the AI Act readiness page. Regional data residency is planned rather than broadly available by default today.
Control mappings and statusWhere is hosted data stored?
The hosted service runs in one Microsoft Azure region, Central US. Regional data residency is planned.
Data handling and privacyCan I verify records independently?
Every Decision Dossier is signed with Ed25519, and the public keys are published. You can verify any dossier offline, without an account and without calling us.
Verification toolsWhere can I find the subprocessor list?
Our infrastructure providers hold ISO 27001 and SOC 2 Type II. Those certifications are theirs, not Decionis's. The full subprocessor list is available on request.
Request the subprocessor listCan Decionis run in our own cloud?
Run the Decionis Authority in your own cloud from the versioned Helm chart, under a commercial license.
Private deployment optionsUpdated · Published by Decionis, Inc. · Contact the team