Trust by design. Evidence travels.
Raw data stays.
Every architectural decision in Provena by AffectLog reflects one principle: diagnostics run where your data lives, and only the signed evidence receipt crosses the boundary.
Evidence travels
Raw data never leaves your environment
Ed25519 signing
Every receipt is cryptographically verifiable
Zero-trust RBAC
Server-side role checks on every route
Immutable audit log
Every action recorded with actor + timestamp
Security headers
Security principles
Eight security controls — by default.
No raw data exported by default
AffectLog never exports raw prompts, raw model weights, raw personal data, or raw documents. Every diagnostic produces a signed Signal Receipt — not a data export. Raw export flags are disabled by default and require explicit opt-in.
Organisation isolation
Every organisation's data is fully isolated at the database and API layer. No supplier data, evidence, or decision is accessible across organisations without explicit sharing consent.
Role-based access control
Access to passports, evidence, decisions, and exports is governed by roles: Owner, Admin, CISO, DPO, Procurement, AI Lead, Reviewer, Member, Vendor Admin. Every API route enforces server-side role checks.
Signed Signal Receipts
Every Signal Receipt is cryptographically signed with an Ed25519 key. Recipients can verify authenticity and integrity without re-running diagnostics. The signing key is never exported.
Audit logs
Every access decision, evidence update, passport change, export, and user action is written to an immutable audit log with actor, timestamp, IP address, and resource ID.
Secrets management
API keys, signing keys, and webhook secrets are stored in environment variables — never in the database or version control. All secrets are rotatable without downtime.
Encryption at rest and in transit
All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Webhook payloads are verified with HMAC signatures before processing.
Local and federated execution
The Edge Capsule allows diagnostic runs inside your own perimeter. Only signed Signal Receipts leave the local environment. Raw data never transits the network.
Signal Receipt signing
Every diagnostic result is signed, not transmitted.
When a diagnostic runs — whether in the AffectLog cloud or the Edge Capsule — it produces a signed Signal Receipt. The receipt contains only the metric name, score, and pass/fail result. No raw inputs are included.
Signal Receipt — anatomy
Security HTTP headers