TRUST CENTER
Security built for governed adversarial validation .
Adversarial validation can touch production apps, APIs, credentials, cloud, Kubernetes, controls, and sensitive systems. Hayrok is designed to make that safer through strong identity, tenant isolation, policy-governed execution, private runners, evidence integrity, and complete auditability.
TRUST CENTERNEED MORE
01 · SECURITY PHILOSOPHY
Security validation should never require giving up control
The more powerful security automation becomes, the stronger its governance must be. Seven architectural commitments underpin every Hayrok request.
§
01
Least privilege
Users, services, agents, and runners receive only the permissions required for their authorized responsibilities.
▣
02
Explicit authorization
Every validation begins with an authenticated user, authorized objective, approved scope, and applicable policies.
⊕
03
Defense in depth
Identity, authorization, network, workload isolation, encryption, and monitoring act as complementary layers.
◫
04
Tenant isolation
Tenant context enforced across authentication, authorization, services, data, evidence, and execution.
◉
05
Governed autonomy
Autonomous agents operate within explicit policies, scope, safety controls, and approval gates.
◆
06
Evidence integrity
Validation conclusions stay connected to the artifacts and execution context that support them.
×
07
Zero implicit trust
Client-provided identity or tenant context is never treated as authoritative simply because it is present.
02 · PLATFORM ARCHITECTURE
Multiple layers protect every Hayrok request
Edge, gateway, authorization plane, service mesh, workloads, and data services operate as complementary controls.
03 · IDENTITY & ACCESS
Identity is established before access is granted
Hayrok distinguishes authentication (who you are) from authorization (what you can do). Client-supplied identity headers are never treated as authoritative.
AUTHENTICATION
Enterprise identity
✓OIDC
✓SAML SSO
✓MFA
✓IdP federation
✓Org-aware auth
✓Session security
✓SCIM provisioning
AUTHORIZATION
RBAC + ABAC via OPA
◆Tenant
◆Organization
◆Role
◆Resource
◆Action
◆Environment
◆Objective
◆Policy state
§
Read a finding ≠ launch a validation ≠ execute a sensitive scenario ≠ accept a risk ≠ change a security policy. Hayrok evaluates every action against tenant, user, role, resource, environment, and policy — so authenticated users cannot silently perform authorization-restricted work.
04 · TENANT ISOLATION
Isolation is a platform-wide requirement, not a database detail
Tenant context is derived from trusted identity and applied across identity, API requests, authorization, data, evidence, AI retrieval, and execution.
Identity
API requests
Authorization
Asset inventory
Findings
Evidence
Reports
Attack graphs
Validation runs
Agents
Integrations
Audit records
AI context
Execution workflows
05 · DATA PROTECTION
Protecting customer data throughout its lifecycle
Controls apply from ingestion through storage, processing, access, retention, and deletion.
TRANSIT
Encryption in transit
TLS across all external traffic. mTLS between internal workloads via the service mesh.
AT REST
Encryption at rest
Customer data, evidence, credentials, and platform records use storage-appropriate encryption.
SECRETS
Secrets management
No secrets embedded in source, images, or manifests. Retrieved from managed secret stores at runtime.
SENSITIVE
Sensitive data
Additional safeguards for credentials, API tokens, integration secrets, and validation evidence.
REDACTION
Evidence redaction
Sensitive fields sanitized before storage; original values never persisted in evidence artifacts.
CMK
Customer-managed keys
Enterprise plans may include customer-managed key options for supported deployment models.
06 · GOVERNED ADVERSARIAL VALIDATION
Every validation operates inside security boundaries
Autonomous agents do not have unrestricted permission to attack. Eight boundaries define what can run, where, and how.
OBJECTIVE
Authorized objective
What security outcome is being tested?
SCOPE
Approved scope
Which assets, environments, identities, or resources are in bounds?
SCENARIO
Scenario policy
Which validation scenarios are permitted for this scope?
SAFETY
Safety class
What impact class can the scenario create?
TOOLS
Tool restrictions
Which tools and actions may agents use?
ENVIRONMENT
Environment controls
Dev, test, staging, production, sensitive production.
LIMITS
Execution limits
Rate, concurrency, runtime, destinations, data modification, destructive behavior.
APPROVAL
Approval gates
Sensitive activity requires explicit human authorization.
HUMAN-IN-THE-LOOP
Approval required for sensitive actions
✋Production adversarial validation
✋Exploit execution against crown jewels
✋Credential usage in real environments
✋Sensitive evidence exports
✋Recurring production testing
✋Governance and policy changes
AGENTS CANNOT AUTONOMOUSLY
Hayrok agents never bypass governance
×Expand target scope
×Grant itself new permissions
×Approve its own restricted activity
×Disable tenant isolation
×Override organizational policy
×Suppress required evidence
×Modify authorization decisions
07 · PRIVATE RUNNER
Keep sensitive validation close to your environment
Separation of control plane and execution plane. Hayrok plans and governs; the customer environment executes.
08 · EVIDENCE INTEGRITY
Every security conclusion has a traceable record
Evidence Fabric connects technical artifacts to the validation context that produced them, using cryptographic hashing, controlled write paths, provenance tracking, and access authorization.
"A finding should never just say ‘critical vulnerability detected.’" Hayrok shows exactly what was authorized, what was performed, what was observed, and which artifacts support the conclusion.
EVIDENCE METADATA CONTRACT
TENANT
acme-prod
RUN
RUN-2411
OBJECTIVE
api-security
SCENARIO
authz-object
ASSET
orders-api
AGENT
exploit-01
TOOL
authz-probe
TIMESTAMP
10:04:22Z
HASH
sha256:a3f2…
APPROVAL
grc-reviewer
09 · NECTAR SECURITY & RESPONSIBLE AI
AI that operates inside the evidence and authorization boundary
Nectar is Hayrok's evidence-grounded intelligence layer. It respects the same tenant and permission boundaries as the rest of the platform.
GROUNDED
Only Hayrok evidence
Answers derive from authorized Hayrok evidence and platform context — never external, ungoverned data.
PERMISSION
Permission-aware
Nectar retrieves only records the requesting user is authorized to access.
VERDICT
Explicit uncertainty
Distinguishes Confirmed, Observed, Inferred, and Unknown. Says so when evidence cannot support the answer.
ADVISORY
Advisory only
Nectar recommends. It does not independently perform high-impact actions.
HUMAN
Human-controlled
Users remain responsible for decisions, approvals, and governed execution.
AUDIT
Auditable use
Meaningful interactions can be recorded to provide visibility into AI use during security workflows.
NECTAR DOES NOT INDEPENDENTLY
×Launches adversarial actions
×Changes production systems
×Expands validation scope
×Approves restricted activity
×Accepts risk
×Changes policies
×Closes findings
×Modifies evidence
10 · APPLICATION SECURITY
Secure development is part of platform security
Controls across the full SDLC — design, source, testing, CI/CD, and production.
DESIGN
Threat modeling, architecture review, security requirements, abuse-case analysis, tenant-isolation review.
SOURCE
Peer review, branch protections, repository access controls, secrets scanning, dependency management.
TESTING
SAST, SCA, container scanning, DAST where appropriate, API security testing, IaC analysis.
CI/CD
Protected pipelines, artifact controls, image scanning, deployment authorization, supply-chain controls.
PRODUCTION
Runtime monitoring, vulnerability management, configuration management, logging, incident response.
11 · INFRASTRUCTURE & WORKLOAD SECURITY
Layered protection across the platform
Cloud-native controls; least-privilege for human and workload identities.
AWS infrastructure
Kubernetes workload isolation
EKS security controls
Service-mesh mTLS
API-gateway enforcement
OPA authorization
Container-image security
Infrastructure-as-code
Network restrictions
Runtime security monitoring
Centralized observability
Least-privilege identities
12 · OBSERVABILITY, AUDIT & RESPONSE
Security-relevant activity is observable, auditable, and actionable
12 · OBSERVABILITY
Security-relevant activity is observable
Centralized telemetry supporting detection, investigation, performance, and audit.
OpenTelemetry
Prometheus
OpenSearch
12 · AUDIT LOGGING
Security actions leave a record
Auth, admin, scope, approval, agent, and evidence events. Audit access is authorization-controlled.
SSO events
Policy changes
Evidence access
12 · VULN MGMT
We treat our own exposure seriously
Scanning, dependency monitoring, SLA-driven remediation, revalidation. Risk-based prioritization.
Risk-based
SLAs
Revalidation
12 · INCIDENT RESP
Prepared to detect, contain, recover
Documented processes for triage, containment, investigation, communication, and post-incident review.
Detection
Containment
Notification
13 · COMPLIANCE & ASSURANCE
Building an enterprise-ready security program — honestly
We publish verified status, not aspirational claims. Certifications are only listed once assessments are complete.
14 · TRUST CENTER DOCUMENTS
Security information when you need it
Public documents are available immediately. Restricted materials require business verification or NDA.
📄
View →
Security Overview
PUBLIC
High-level overview of Hayrok's security architecture, controls, and philosophy.
security·Reviewed Aug 2026
📄
View →
Platform Architecture Overview
PUBLIC
How requests flow through edge, gateway, authorization, mesh, and workloads.
architecture·Reviewed Aug 2026
📄
View →
Data Protection Overview
PUBLIC
Encryption, sensitive data handling, secrets, and lifecycle controls.
privacy·Reviewed Aug 2026
📄
View →
Responsible AI Principles
PUBLIC
How Nectar retrieves, grounds, and cites — and what it never does independently.
ai·Reviewed Aug 2026
📄
View →
Vulnerability Disclosure Policy
PUBLIC
Safe-harbor terms and reporting process for security researchers.
security·Reviewed Aug 2026
📄
View →
Privacy Policy
PUBLIC
Data collection, purpose, retention, and subject rights.
privacy·Reviewed Aug 2026
📄
View →
Subprocessor List
PUBLIC
Current list of subprocessors, purpose, data type, and processing location.
privacy·Reviewed Aug 2026
📄
View →
Business Continuity Overview
PUBLIC
Resilience strategy, backup approach, and recovery objectives at a high level.
security·Reviewed Aug 2026
📄
Request →
Detailed Security Architecture
NDA REQUIRED
Deep architecture: identity, authorization, data flow, workload isolation, key management.
architecture·Reviewed Aug 2026
📄
Request →
Security Control Matrix
NDA REQUIRED
Mapping of Hayrok controls to SOC 2, ISO 27001, NIST, CSA CAIQ.
compliance·Reviewed Aug 2026
📄
Request →
Penetration Test Executive Summary
NDA REQUIRED
Third-party test findings and remediation status from the most recent engagement.
security·Reviewed Jul 2026
📄
Request →
Incident Response Plan Summary
NDA REQUIRED
Detection, triage, containment, investigation, communication, and review procedures.
security·Reviewed Aug 2026
📄
Request →
Data Flow Diagrams
NDA REQUIRED
How customer data moves through the platform, including evidence and integrations.
architecture·Reviewed Aug 2026
📄
Request →
Secure Development Standard
NDA REQUIRED
SDLC controls, review requirements, testing gates, and deployment authorization.
security·Reviewed Aug 2026
16 · SUBPROCESSORS
Transparency into providers
AWSCloud infrastructure
AWSCloudflareEdge / WAF
CloudflareDatadogObservability
DatadogStripeBilling
17 · SERVICE STATUS
Operational transparency
Hayrok applicationOperational
AuthenticationOperational
Validation control planeOperational
Runner communicationOperational
Evidence servicesOperational
18 · RESPONSIBLE DISCLOSURE
Help us improve Hayrok security
Security researchers can report vulnerabilities responsibly.
◆Contact: security@hayrok.io
◆PGP available
◆Safe-harbor for good-faith research
19 · SECURITY FAQ
Common questions
Does Hayrok require direct access to our internal network?+
Not necessarily. Public validation can use Hayrok-managed execution. Internal environments use Customer Runner or Private Runner deployments — communication is outbound-only from your environment.
Can Hayrok agents expand their own scope?+
No. Agents operate only within the authorized scope. Any scope change requires re-authorization and, for sensitive changes, human approval.
Can sensitive validation require human approval?+
Yes. High-impact or sensitive workflows can require explicit approval before execution. Approvers see the objective, scope, planned actions, tools, and safety class.
How does Hayrok protect service-to-service traffic?+
The platform uses mutual TLS between workloads via the service mesh, plus workload identity and service-level authorization policies.
Does Hayrok support SSO and SCIM?+
Enterprise identity capabilities support SSO (OIDC/SAML) and SCIM provisioning where enabled by the customer plan.
Is customer data shared across tenants?+
No. Tenant isolation is enforced across identity, API requests, authorization, data access, evidence, and execution. Cross-tenant access through normal platform functionality is prevented by design.
Does Nectar train on our data?+
No. Customer data is not used to train Nectar's underlying models. Retrieval is scoped to the requesting user's tenant and permissions. Model-provider details are published in the Responsible AI Principles.
Has Hayrok completed SOC 2?+
SOC 2 Type II is currently in preparation. Readiness is complete; the Type I audit is scheduled. Refer to the Compliance section for the most current verified status.
20 · ENTERPRISE SECURITY REVIEW
Need more detail for your assessment?
Security, procurement, legal, privacy, and architecture teams can request additional documentation.
◆Security questionnaire (CAIQ, SIG)
◆Architecture review
◆Data-flow review
◆Privacy review
◆AI security review
◆Deployment review
◆Private Runner architecture
◆Compliance roadmap
REQUEST FORM
Request Security Review
NAME
Your name
BUSINESS EMAIL
you@company.com
COMPANY
Company name
ROLE
Security · GRC · Legal · Architect
REVIEW TYPE
Full security reviewArchitecturePentestPrivacy
NOTES
Documents requested, NDA status, deadlines…