Security & trust
The record is the product — so it's built to be believed.
InterceptAI is an accountability control. Its oversight ledger is append-only, hash-chained, and its immutability is enforced at the database layer — not by convention. A signed export and an external anchor let a third party verify it without trusting us.
Audit-trail integrity
Tamper-evident by construction.
Append-only, enforced by the database
A trigger plus revoked UPDATE/DELETE grants mean the application role can add to the ledger but never rewrite it — immutability that holds even against the app itself.
Hash-chained & verifiable
Each entry commits to its predecessor. A verify pass re-derives every hash and walks the links, locating any alteration by sequence number.
Third-party provable
A signed export bundle verifies offline, and a periodic external anchor lets an auditor confirm the chain without our keys — tampering after the fact is detectable.
Attributable
Every consequential action, hold approval (with the reviewer), and undo (with the actor) is recorded — authorized-versus-actual, across multi-agent chains.
Data protection
Least privilege, tenant isolation, redaction.
Redaction by construction
The record stores hashes and summaries only — there is no raw-arguments field, and the logs carry messages, never arguments, headers, or bodies.
Tenant isolation
Every read and write filters on tenant, proven by a cross-tenant leakage test suite. A two-role database keeps the runtime least-privilege.
Access & secrets
Console RBAC from your OIDC provider, per-caller service credentials that rotate, and secrets from env, a mounted file, or Vault — never in the repo, never logged.
Compliance groundwork
The artifacts a reviewer asks for.
Not the audit itself — the SOC-2 Type-I groundwork that lets one start. Each control points at its evidence in the codebase.
- Security policy — access control, data handling, cryptography & key management, logging, availability, change management, and BC/DR.
- Threat model — assets, trust boundaries, and STRIDE threats with the mitigation for each.
- Control-to-evidence map — the SOC-2 Trust Services Criteria mapped to controls, each naming a file, migration, test, or doc.
- SIEM export — stream signed, redacted records to Splunk, S3, or any HTTP collector, and manage console roles from your IdP.
Resilience
Safe under load, and safe when a dependency fails.
Fail safe, not open
If scoring or the ledger is unavailable, a high-consequence action holds — never a silent allow. Safety over availability, by design.
Horizontal scale
The gateway is stateless; run N replicas behind a load balancer. Any replica can resolve any held action — tested, no correctness regression.
Backup & recovery
Back up and restore with the hash chain still verifying afterward. Run managed Postgres with a standby and point-in-time recovery.