Built to be trusted with what it observes.

SECURITY ARCHITECTURE

ARCHITECTURE

Runtime → control plane → console

The Runtime observes and reports. The control plane receives, verifies and stores. The console reads. No component needs more access than that path requires.

IDENTITY

Cryptographic identity per Runtime

Each Runtime holds its own Ed25519 identity, issued at enrolment. A Runtime cannot speak for another.

TELEMETRY

Signed telemetry

Reports from a Runtime are signed so the control plane can verify origin and integrity before anything is assessed or shown.

ISOLATION

Tenant isolation

Organisations are isolated from each other in storage and in access. Groups inside an organisation are labels for filtering, not security boundaries.

DATA

Data minimisation

The console receives what is needed to assess an application — components, versions, changes, identities, connection state — not the application's content or its users' data.

CONDUCT

No hack-back

Ruddiment does not attack, probe or retaliate against third parties. Observation is limited to the enrolled application.

RESPONSE

Governed response

Governed response is roadmap work. A bounded plugin-update path has local test evidence but is disabled in the hosted beta. Execution requires explicit human approval; autonomous remediation is not available.

DISCLOSURE

Responsible disclosure

Report a suspected issue through the Contact page. Do not include passwords, access tokens or customer data in the first message; the founder will arrange an appropriate way to share details.

CERTIFICATIONS · none are claimed. Ruddiment does not currently hold SOC 2, ISO 27001 or equivalent attestations. This statement will be updated only when an attestation is held.