Built to be interrogated by an adversary — and an auditor.
Every after-the-fact revision is either cryptographically impossible or cryptographically evident — including revision by ConstatVault itself. Below is the threat model, stated as adversary → mitigation.
Independent security audit: in progress. The cryptographic core is scheduled for third-party review, with the report published in full — including any findings — in Q1 2027. Until then, every claim on this page is checkable against the public verifier and the evidence bundle.
| Adversary / failure | Mitigation |
|---|---|
| Agent forges or suppresses its own history | Network-layer capture at the gateway/sandbox/MCP chokepoints — the agent holds no keys and needs no SDK, so it cannot write or omit its own record. |
| Tenant edits history after an incident | Per-agent hash chain + published daily Merkle seals + Bitcoin anchor — any edit breaks a link and contradicts a block that was mined before the dispute. |
| ConstatVault edits history | Same public seals + OpenTimestamps proofs; we cannot rewrite a Bitcoin block either. The guarantee explicitly binds the operator. |
| Compromised agent object / leaked subkey | Blast radius = one agent × a ≤48-hour subkey window. Private subkey halves are generated locally and never cross an RPC boundary. |
| Forged ingest traffic | Per-source HMAC over the raw body, constant-time verify, replay dedup, and rejection of timestamps >5 minutes in the future. |
| Silent refusal / selective dropping | Refusals are signed gap markers with a reason — never a silent drop. An auditor distinguishes "nothing happened" from "something was refused." |
| Key-holder equivocation / tip rewrite | Public transparency log + independent witness quorum + gossip monitor + forward-secure tip keys (a stolen key can't forge past epochs). |
| Back-dating a timestamp | A public-randomness beacon lower bound + a TSA/Bitcoin upper bound sandwich occurrence time to minutes; back-dating is cryptographically impossible. |
| Break of one hash or signature family | Hybrid-AND signatures (three families), a sha256‖blake3 robust combiner, a dual-hash transition, and RFC 4998 re-notarisation. |
| Weakened certificate issuance | Fail-closed by construction — the engine refuses to issue rather than emit a certificate that shouldn't exist (proven live: Attestation refuses without a verified licence). |
| Operator abuse | Cloudflare Access + origin JWT verification; fail-closed OPERATOR_ROLES (unset ⇒ 403; unknown ⇒ read-only, never admin); every mutating action attributed server-side and signed. |
| KEK compromise blast radius | Per-tenant HKDF-derived KEKs, plus an injectable provider for bring-your-own-key (below). A single leaked ciphertext compromises one tenant, not all. |
Bring-your-own-key (BYOK)
All private key material is AES-GCM-wrapped under a versioned envelope. EvidenceVault derives a distinct per-tenant KEK (HKDF-SHA256) and ships an injectable KekProvider with a HashiCorp Vault Transit provider — key material never leaves the customer's KMS; the platform stores only ciphertext. Legacy blobs decrypt and re-wrap on next write; no flag-day migration.
Fail-closed by default
An unset operator-roles map used to mean "everyone is admin." It now returns a hard 403 before any route, and an unknown operator resolves to read-only. Access to admin surfaces is gated by Cloudflare Access with fail-closed JWT verification. This is the class of interim default that becomes a breach notification — fixed by construction.
The anomaly model is transparent — by design, for the witness box
For litigation defensibility the detector is a transparent, auditable linear model, not a black box: score = σ(bias + Σ wᵢ·featureᵢ). Every score is reproducible by hand from the stored feature vector and the published weights. An expert witness can recompute any score independently.
Thresholds are not tenant-configurable — a customer under pressure cannot quietly tune the detector into silence, which is exactly what an insurer or regulator would want to know is impossible. There is no opaque training corpus; the only ML component is embedding drift, computed with a published, versioned public model whose cosine-distance output is itself reproducible.
Our own SOC 2 posture
Eight documented policies across both platforms — Information Security, Access Control, Change Management, Incident Response, Data Retention & Disposal, Encryption & Key Management, Business Continuity & DR, Vendor Management — with a readiness checklist mapping Trust Services Criteria → control → evidence. Formal SOC 2 Type II is a scheduled activity, not an engineering gap.
Supply-chain discipline
A 72-hour dependency cooldown (minimumReleaseAge) blocks freshly-published packages; all cryptography lives in one audited shared library, never inlined in a worker; strict typing with no DOM lib; property-based and chaos testing; deterministic golden-fixture byte-equality gates.
The governing invariant
None of these mechanisms is required to verify an already-issued artifact. A verifier with no network access still checks signatures, canonical hashes, Merkle roots, and validity windows. A certificate issued today remains verifiable if every one of these parties ceases to exist tomorrow. Verify one yourself →