Provenex trust page
Written from the code, including the limits
Provenex reconstructs what your AI agents actually did across steps, sessions, and tools, and can enforce policy where the evidence supports it. A product whose pitch is verifiable evidence owes you a trust page with the same standard: every claim below is written from the shipping product, and the limits are stated in place instead of rounded up.
What runs where
In your perimeter: the Provenex Edge (a Docker Compose stack you install) holds raw telemetry, content, receipts, the lineage graph, policy and trust configuration, the local console, and the append-only evidence store in your own PostgreSQL. Enforcement points run next to it and forward allowed traffic to upstreams you configure.
Hosted by Provenex: a scoring service that receives one minimized request per live decision and returns a signed verdict. It keeps no store of request payloads. The Edge requires this endpoint to evaluate live actions; Provenex is not an air-gapped product today.
What leaves your perimeter
Raw prompts, message bodies, retrieved content, end-user identities, and receipts never leave your deployment. Each live decision sends one versioned, minimized, size-bounded request describing the shape of the flow:
- salted-hash identifiers for the agents, systems, and destinations in the flow; the salt stays on your Edge, so the hashes mean nothing anywhere else;
- the graph topology between them and the trust labels assigned to them;
- per-node UTC timestamps (the timestamps themselves are not hashed) and numeric risk scores;
- your trial key as authentication, so scoring traffic is attributable to your tenant.
The console's data custody view shows every field of the actual outbound request before live enforcement is enabled, so the complete envelope is inspectable in your own install rather than transcribed here, and what Provenex cannot see states the blind spots with the same prominence as the catches.
How failure behaves
If the scoring service is slow or down, each destination rule decides: fail
closed returns a 503 and blocks; fail open forwards the request flagged distinct
from a scored allow. In Provenex's own accounting a fail-open is an unenforced
action and is counted as one: an exported Prometheus counter and a greppable
PROVENEX FAIL-OPEN log line keep the durable history, and the
console shows the Edge's own count since its last restart. The default posture
is fail open, so an outage in our service degrades your protection, not your
production. Fail-closed takes effect only once a boundary is in enforce mode;
in observe mode nothing is ever withheld. The product's own verification run
reports a dead scorer as a failed or inconclusive run, never a green one.
Evidence and keys
Verdicts, enforcement receipts, and control records are signed with ed25519, and every signed envelope carries the exact canonical bytes the signature covers, so evidence verifies independently of any Provenex service. A standalone open verifier labels demo-key signatures as examples rather than proof. Signing keys are environment-injected secrets with named key ids; verdict verification uses a key ring that retains historical keys across rotation. The full picture, including what a compromise means and every gap, is written down in the key-management document.
What we do not claim
- No SOC 2, ISO 27001, or HIPAA attestation today; targeted post-pilot. This page, the data custody view, and the signed evidence trail are the interim packet.
- No KMS or HSM key custody yet, and no automated key rotation.
- The local ledger is append-only with per-row signatures, but an administrator restoring an older copy of the whole database is not detectable today; external anchoring is roadmap.
- Evidence tables are per-row signed and append-only by application design; database-level tamper guards and hash-chaining are not yet complete across all of them, and finishing that is tracked roadmap work.
- The daily-run corpus is deliberately adversarial-heavy; it demonstrates detection on known-shape incidents, not a false-positive rate on benign traffic.
Continuity
Everything evidentiary is already yours: the ledger, receipts, and
configuration live in your PostgreSQL and keep working for audit without us.
Uninstall is docker compose down plus a decision about whether to
keep your own volumes. For pilot-to-production conversions we offer source code
escrow with a standard release-on-cessation agreement.