Security
Security and data handling
No query text is ever stored. Here is what we keep and what we've tested.
Where it runs
Offline bundle Prototype
For CUI and air-gapped sites. You run our query container inside your boundary and import signed, versioned index releases, designed to verify offline. Queries never leave your network, so there's nothing for us to store.
Hosted, over TLS Non-CUI
For non-CUI evaluations and workloads. Your agents call the hosted API over HTTPS (TLS) with an API key, using public or synthetic inputs only. GovCloud is planned.
What we keep
Query text is never stored. We keep only usage counts for metering. Separately, we keep short-lived operational logs and account records, none of which contain query text.
| Data | Kept | What it contains |
|---|---|---|
| Query text and returned passages | Never stored | Held in memory for the duration of the request only. Not written to logs, metrics, traces, error reports, search slow logs, usage or billing records, or support bundles. Not hashed either, because short queries can be guessed from a hash. No query-keyed caches and no query history. |
We say "no query payload logging", not "no logs".
Security you can check.
We'd rather show evidence than claim certifications.
- Query service: no outbound calls
- The query service answers from its own index with no route to the internet, demonstrated locally. Our website and console services are separate and do connect to the internet.
- Signed, verifiable releases
- Offline releases carry a signed manifest with a hash for every file and an SBOM, and are designed to verify without a network connection.
- Citations and freshness
- Every result shows its source, pinpoint, published and checked dates, and a stale flag.
- Non-CUI hosted, CUI offline
- The hosted service is for non-CUI work. For CUI and air-gapped environments, use the offline bundle inside your boundary.
- CMMC sources
- We index 32 CFR 170 and NIST SP 800-171, so your agents can cite the rule and the requirements.
What we've tested
- Query service: no internet route, demonstrated locally. Demonstrated locally for the query service: sentinel queries were absent from its responses, logs and stores, and it had no route to the internet. The query service's no-egress setup is tested in our local builds. See egress evidence.
- Offline bundle: no call-home, verified by automated test.
The isolation we describe applies to the query service; our website and console services are separate and do connect to the internet.
Evaluations use public or synthetic inputs only. If your program needs CUI or other regulated data, talk to us about an on-prem deployment.
SecureScout SI is provided by Vaultayn Inc., a California corporation.