Security & Architecture — Governe by Aiebo

The architecture

Two planes, one rule.

The control plane defines and observes. The runtime plane enforces and routes. Payloads only ever exist in the second — which runs in your environment.

Control plane · Governe SaaS (multi-tenant)

Defines, governs, observes — never sees payloads

Onboarding & tenantsUsers & RBAC / SSOPolicies engineBudgets & leasingKeys & credentials (hashed)Agent inventoryAI estate & catalogDashboards & metricsAudit & compliance

↓ signed & encrypted policy snapshots, leases, key hashes, config

↑ usage aggregates, costs, health, heartbeats (async)

Runtime plane · your network

Enforces locally, routes requests, captures telemetry

Gateway & router (single enforcement point)Key authGuardrails: PII, prompt injection, content filtersRAG & tools layerAudit & usage buffer (durable queue)

🔒 Prompts, completions & documents stay here

→ routes to OpenAI · Azure OpenAI · Anthropic · Google Vertex · AWS Bedrock · other providers

Data handling

What our cloud sees — and what it never does.

Data	Reaches Governe cloud?	Notes
Prompts, completions, embeddings, documents	Never	Exist only inside your runtime plane and your model providers.
API keys & credentials	Hashes only	Raw keys never leave your environment; revocation propagates in ≤ 60 seconds.
Usage & cost telemetry	Aggregates, async	Buffered locally (durable queue), batched upstream; survives network loss.
Inventory metadata (app names, owners, models, vendors)	Yes	This is the record — the minimum needed to govern.
Policy definitions & audit events	Yes	Signed policy travels down; enforcement decisions are logged for evidence.
Training data for our models	Never	We do not train on customer data. Contractually.

Design principles

Built for the failure cases.

Runtime never calls home in the request path

Every enforcement decision is made locally from signed policy snapshots. Governe cloud latency — or an outage — can never slow or block your AI traffic.

Offline-first, fail-safe by policy

Intermittent or air-gapped networks enforce from cache with a configurable staleness window — fail-closed or allow-with-audit, your choice.

Bounded overspend via budget leasing

Budgets are enforced as leases, so even a disconnected runtime cannot exceed its granted allowance.

≤ 60-second revocation

Compromised keys and revoked agents propagate to every enforcement point within a configurable SLA of one minute.

Evidence by default

Every policy change, approval, and enforcement decision is recorded — versioned, backward compatible, ready for auditors.

Hashed keys & signed tokens

The control plane stores key hashes, never raw credentials. Policy snapshots are signed and encrypted in transit.

Deployment

Run it where your risk profile says.

Recommended for most enterprises

Customer-deployed

Full data residency and control — Kubernetes, VM, or bare metal
Works offline from cached, signed policy
You operate the gateway in your VPC or data center
Local storage for audit buffer (SQLite/Badger)

Managed

Governe-hosted · single-tenant

We operate the gateway for you — same architecture, same guarantees
Deployed in your isolated, single-tenant VPC
Encrypted storage, Kubernetes-managed
Same payload rule: your content never reaches our multi-tenant cloud

Compliance status — stated plainly

We publish our posture honestly rather than borrowing badges. Controls are designed against SOC 2 and ISO 27001; HIPAA-ready deployment patterns are supported. Certification status below is kept current — ask us for the detailed control mapping under NDA.

SOC 2 — aligned · audit in progress ISO 27001 — aligned HIPAA — deployment-ready No training on customer data — contractual

Security contact: security@aiebo.ai · We welcome coordinated disclosure.

Schedule an AI Assessment