Built to be trusted with what it observes.

SECURITY ARCHITECTURE

ARCHITECTURE

Runtime → control plane → console

The Runtime observes and reports. The control plane receives, verifies and stores. The console reads. No component needs more access than that path requires.

IDENTITY

Cryptographic identity per Runtime

Each Runtime holds its own Ed25519 identity, issued at enrolment. A Runtime cannot speak for another.

TELEMETRY

Signed telemetry

Reports from a Runtime are signed so the control plane can verify origin and integrity before anything is assessed or shown.

ISOLATION

Tenant isolation

Organisations are isolated from each other in storage and in access. Groups inside an organisation are labels for filtering, not security boundaries.

DATA

Data minimisation

The console receives what is needed to assess an application — components, versions, changes, identities, connection state — not the application's content or its users' data.

CONDUCT

No hack-back

Ruddiment does not attack, probe or retaliate against third parties. Observation is limited to the enrolled application.

RESPONSE

Governed response

Responses are proposed from evidence, reviewed by an operator and verified by the Runtime. The Developer Preview does not execute responses.

DISCLOSURE

Responsible disclosure

Security issues in Ruddiment itself can be reported through the repository's security policy and will be acknowledged. A disclosure policy is provided with the Developer Preview.

CERTIFICATIONS · none are claimed. Ruddiment does not currently hold SOC 2, ISO 27001 or equivalent attestations. This statement will be updated only when an attestation is held.