Security
1. Platform protections
- Encryption in transit (TLS) and at rest for customer data and compiled artefacts.
- Least-privilege access control for staff, with access to production granted on need and logged.
- Environment isolation between prototype, verification, and managed production workloads.
- Audit logging of privileged operations, deployments, and verdict issuance.
- Automated dependency and vulnerability scanning in the build pipeline.
2. Verification evidence
ShipGate verdicts are ed25519-signed and content-addressed. The signature covers the artefact hash and the evidence set behind the verdict, so a verdict can be checked independently and cannot be silently altered after issuance.
3. Application security in what we compile
Compiled applications enforce permissions, ownership, and workflow invariants declared in the intent contract at the database and API boundary, not only in the interface. Verification includes checks against security boundaries and command effects. You remain responsible for the security decisions expressed in your own intent, and for anything you change after deployment.
4. Reporting a vulnerability
Send reports to security@wholestack.ai, including reproduction steps and impact. We acknowledge within 2 business days and aim to provide a remediation plan within 10 business days. Please give us reasonable time to fix an issue before publishing.
Test only against your own accounts and applications. Do not access other customers’ data, degrade the service, or run destructive tests. Good-faith research within these bounds will not be pursued by us.
5. Incidents
If an incident affects your data, we will notify affected customers without undue delay, describe what happened and what we are doing, and meet the notification obligations that apply under the Privacy Policy and applicable law.