BYOK by defaultKeys stay out of our database.Anthropic, OpenAI, Google, Azure — provider keys are stored server-side in GCP Secret Manager (your tenancy on Enterprise; ours on Free/Pro/Team, with CMEK). Hub Core decrypts them only to route your request, and our database stores only a masked hint.
No managed inferenceWe don't supply the LLM.Every prompt is answered by your provider, on your own BYOK key — Clevername is the policy engine in front, never the inference layer. We do operate compute for some governance checks; see the exceptions note below.
Audit-firstTamper-evident, exportable.Every governance decision and policy hit gets a SHA-256 hash-chained audit entry. Export to Splunk, Sentinel, Datadog, or Elastic. 7-day retention on Free, 30-day on Pro, 365-day on Team, and unlimited retention on Enterprise.
Self-host optionSame Docker image, your VPC.Enterprise customers run the full platform — Hub Core, CleverGuard ML sidecar, audit log — inside their own infrastructure. Prompts, responses and audit records never leave your perimeter. The only outbound call is a daily license heartbeat (license ID, instance ID, version, seat and agent counts — no customer data), which AIRGAP=true disables entirely.
Managed governance compute (exceptions)Full transparency: Clevername pays for the compute behind some governance checks. CleverGuard’s ML injection classifier, CleverGuard’s Tier-3 deep-scan judge, ClaimGuard’s claim extractor, ScopeGuard’s mandate extractor, the questionnaire extractor, the agent-questionnaire prefill button, and false-positive report review all run on Clevername-operated, self-hosted models — not a third-party or customer-provided model, and with no live fallback to a managed provider if the self-hosted service is unreachable (the step is skipped or the request fails rather than being routed elsewhere). CleverGuard’s Tier-2 classifier and Tier-3 judge run on Clevername-operated GPU Cloud Run in us-east4 and us-central1; ClaimGuard’s extractor runs on a Clevername-operated AWS GPU host. The agent-questionnaire prefill button was the last lane to move onto our own hardware, on 14 September 2026; until then it sent the description and workflow file you pasted into the new-agent wizard to Google’s Gemini API on our key. ClaimGuard’s stored evidence spans are encrypted at rest when you have the optional at-rest I/O encryption (beta) turned on — the claim text, subject and verdict reason on the same row are not, and are readable by us. ScopeGuard’s scope embeddings also run self-hosted: agent request text and your configured forbidden-action descriptions are embedded by a Clevername-operated BGE model on our own infrastructure — they are not sent to a managed embedding provider. The exception is Scout, our in-app support assistant: it sends the questions you type into the support widget (and the public help articles it retrieves) to Anthropic on Clevername’s own key, and embeds them with OpenAI’s Embeddings API (both listed sub-processors in our DPA). Scout never has access to your agents’ prompts, responses, or logs. Neither provider trains on API data. None of these touch the model that answers your prompts — that always runs on your own provider key.
What we run, every dayContinuous testingMonthly automated pen-test reportAn automated, read-only pen-test routine runs against staging on the first of every month and opens its report as a PR — no exploitation, no payload-bearing traffic. A separate daily live-scanner gate checks CleverGuard's detection and false-positive rates against fixed thresholds. The full governed pipeline (including the beta Tier-3 deep scan — which runs on every request for governed agents, not just ambiguous ones; ungoverned traffic only escalates to Tier-3 on ambiguity or a Tier 1/2 disagreement) reaches 94.8% detection on our in-distribution 310-attack red-team corpus, at a 14.75% false-positive rate on the mixed benign/attack eval (588 total rows). The always-on Tiers 0–2 baseline measured against live traffic is 94.7% / 2.66% FP on in-distribution attacks (see /cleverguard); generalization to novel attack styles is lower and actively being improved. Tier-3 is Clevername-operated self-hosted governance compute, wired for governed production traffic, and still labeled beta. These are our own internal test sets, not an independent third-party benchmark.
Database postureRLS audit runs in CI and nightlyEvery Postgres table on Supabase is checked for row-level security policy presence and correctness — in CI on every push, where the check gates the deploy if a new table ships without RLS enabled, and nightly on Cloud Scheduler. Covers all production tables.
Supply chainCI gates on dependency CVEsEvery push runs pip-audit (Python) + npm-audit (TS) + Trivy (containers) in CI (GitHub Actions). High-severity findings block merge. Recent example: python-multipart 0.0.26 → 0.0.27 bumped same-day for CVE-2026-42561.
Network isolationHub Core is privateCloud Run ingress is restricted to internal-and-cloud-load-balancing via GCP org policy. Browser traffic enters through the Vercel proxy → external HTTPS LB → Cloud Run. Direct *.run.app URLs are not reachable from the public internet.
