Security & procurement
The same cryptography that satisfies an auditor is the product. Decision Keep is evidence-first: it can't silently alter what it records, and your auditors can verify it offline - no account, no trust, no vendor required.
Your keys sign your evidence
Every decision is signed with a key that belongs to your organisation. We can't read, alter or forge the evidence, and your auditors only need your published key to verify it.
Tamper-evident by construction
Each entry is cryptographically sealed and linked to the one before it. If anyone changes a record, the chain breaks in full view and is caught immediately and permanently.
Encrypted at rest and in transit
Signing keys are encrypted at rest. Sessions are protected in transit with strong transport security and strict cookie controls.
Strong access control
Accounts enforce a strong password policy, automatic lockout, and multi-factor authentication with recovery codes. Sessions use short, enforced timeouts.
Boundary protection
Every change is protected against cross-site request forgery, with a strict content security policy, clickjacking protection, and third-party analytics blocked on all evidence routes.
Audit trail and monitoring
An append-only audit trail and security-event log record every privileged action. Monitoring, an alerting fail-safe, and offline ledger verification are included.
Who touches your evidence
In the self-hosted deployment, the evidence touches no sub-processor. The ledger, keys and payloads live on infrastructure you control. Any optional integration - your own identity provider (OIDC), an independent time-stamping authority, or a billing provider for your own subscriptions - is your choice and your configuration. Nothing is shared with a third party unless you wire it up.
In the managed deployment, we operate the host for you, and the standard sub-processor list is available on request. Either way, the verification story is identical: the records are yours, and they are checkable offline.
Network exposure & the metrics endpoint
The Prometheus scrape endpoint (/api/metrics) is unauthenticated by design so your own monitoring can pull it without a token. Because of that, it must never face the public internet. Bind it to an internal interface, front it with an allow-listed reverse proxy, or gate it behind CRON_SECRET, and keep a default-deny firewall between it and anything outside your monitoring network. The full exposure guidance lives in the deployment docs and threat model.
Documents for procurement
We've written the packs your security and procurement teams will ask for, so evaluation starts from something real rather than a blank page:
- ✓SOC 2 control mapping - Common Criteria mapped to the code we actually ship
- ✓Threat model with likelihood, impact and a control for each risk
- ✓Incident-response runbook plus a scheduled game-day drill
- ✓Operational runbook and secret-management guidance
- ✓Observability and tamper-monitoring guidance
- ✓Legal review checklist and a DPA template you can send straight to procurement
A formal SOC 2 Type II or ISO 27001 report is an independent engagement (scoped and paid for separately). These documents let your assessor start from implemented rather than unknown.