Security center
Start with architecture, control status, data handling or agent trust. See the available records and the questions that still need a release-specific answer.
Current control information, clearly scoped
Security architecture and control status
Security architecture
Control architectureRole, MFA, and customer scope
Regional boundary and protected records
Policy, approval, and stop conditions
Decision, result, and review trail
Dayrook resolves the principal, active tenant, customer, data region, session assurance, role, and entitlement before protected work reaches a domain owner.
The owning route or service checks RBAC/ABAC, MFA, billing state, approval, consent, purpose-bound secret access, and the current resource state.
Selected-region services, workers, PostgreSQL, Valkey, and object storage run the operation; agents and collectors independently verify signed machine instructions and local policy.
Allow, deny, material failure, provider result, retry, dead letter, rollback, restore, and customer communication evidence returns to the owning workflow and audit path.
Vultr records active US and EU VKE, PostgreSQL, Valkey, load-balancer, and regional storage foundations; remaining public edge, certificate, runtime, and customer-workflow proof stays explicit.
Overview reviewed 2026-08-15The requirements record deployed tenant-isolation tests against the canonical US and EU database targets while broader product and provider journeys still require release-specific evidence.
Overview reviewed 2026-08-15mTLS identities, pinning, signed envelopes, expiry, nonce, replay checks, and local policy are defined and build-tested; real signed-device and collector runs remain release evidence.
Overview reviewed 2026-08-15The security model requires encrypted regional data and state, object encryption for backups, client-side Vault item encryption, purpose-bound secret references, short-lived grants, and no plaintext secret logging. Release-specific runtime and recovery evidence remains part of diligence.
Overview reviewed 2026-08-15Security concerns and suspected vulnerabilities can be routed through the security inquiry path. Triage, containment, remediation, evidence, and disclosure follow the incident process; no public severity-response deadline is claimed without an approved operating commitment.
Overview reviewed 2026-08-15Sentry projects and PostHog dashboards are provider-recorded, but complete deployed, privacy-reviewed event and incident receipts remain pending.
Overview reviewed 2026-08-15Architecture and control requirements support readiness work. Certification, legal compliance, BAA, DPA, or customer-specific claims require the appropriate external audit, assessor, legal review, approved agreement, and current evidence.
Overview reviewed 2026-08-15Questions, answered
This security center is the public entry point; access to detailed evidence can depend on sensitivity, approval, and an evaluation relationship.
AI can use only the configured provider, model, tools, tenant scope, role, autonomy level, and approval path permitted for the workflow.
See the subprocessor and DPA pages, noting their published approval and effective status.
