Trust center
Current operational boundaries.
This page describes what the checked-in application supports and, just as importantly, what remains unverified or unimplemented. It is not a certification, compliance statement, or security guarantee.
Current operating mode
EthosGate is currently positioned as a Shadow + Advisory pilot. A displayed decision does not authorize execution, and this site does not claim a live protected-action enforcement deployment.
Tenant and access boundaries
The workspace data model associates operational records with a workspace and the application checks authenticated membership for workspace operations. This is an application-level isolation control; it is not a claim of independently audited multi-tenant isolation or a substitute for a customer security review.
Encryption
The repository does not provide evidence sufficient to make a public claim about encryption at rest, customer-managed keys, or regional residency. Transport and platform-managed protections should be assessed for a specific pilot deployment rather than assumed from this site.
Logging and audit
The application records decision, review, and audit-related information for workspace workflows. Its ledger linking is not described here as an immutable or externally verified cryptographic chain.
Incident handling
No public incident response commitment, response-time guarantee, or certification is represented. Pilot incident contacts, escalation paths, and responsibilities must be agreed in writing before handling sensitive production workflows.
Retention and deletion
The current pilot does not publish a configured retention schedule, deletion service level, or data-residency commitment. Those controls remain deployment and agreement dependent.
Subprocessors
No public subprocessors list is published for this pilot. Any deployment-specific providers and data flows should be disclosed and reviewed before a pilot processes non-public data.
Known limitations
Not yet represented as available.
- • Verified public registration, email verification, password recovery, and MFA.
- • Production enforcement, a verified external protected-action integration, or a broadly available public API.
- • Independently verified ledger integrity, compliance certification, service-level commitments, or production monitoring guarantees.