BYOK by defaultKeys stay out of our database.Anthropic, OpenAI, Google, Azure — provider keys are stored server-side in GCP Secret Manager (your tenancy on Enterprise; ours on Free/Pro/Team, with CMEK). Hub Core decrypts them only to route your request, and our database stores only a masked hint.
No managed inferenceWe don't supply the LLM.Every prompt is answered by your provider, on your own BYOK key — Clevername is the policy engine in front, never the inference layer. We do operate compute for some governance checks; see the exceptions note below.
Audit-firstTamper-evident, exportable.Every governance decision and policy hit gets a SHA-256 hash-chained audit entry. Export to Splunk, Sentinel, Datadog, or Elastic. 7-day retention on Free, 30-day on Pro, 365-day on Team, and contract-defined retention on Enterprise.
Self-host optionSame Docker image, your VPC.Enterprise customers run the full platform — Hub Core, CleverGuard ML sidecar, audit log — inside their own infrastructure. Prompts, responses and audit records never leave your perimeter. The only outbound call is a daily license heartbeat (license ID, instance ID, version, seat and agent counts — no customer data), which AIRGAP=true disables entirely.
Managed governance compute (exceptions)Full transparency: Clevername pays for the compute behind some governance checks. CleverGuard’s ML injection classifier, CleverGuard’s Tier-3 deep-scan judge, and ClaimGuard’s claim extractor run on Clevername-operated, self-hosted, Clevername-trained models — not a third-party or customer-provided model, and with no live fallback to a managed provider if the self-hosted service is unreachable (extraction is skipped rather than routed elsewhere). ScopeGuard’s scope embeddings are the exception: today they are generated through a managed provider (OpenAI’s Embeddings API, a listed sub-processor in our DPA) using Clevername-paid keys — agent request text and your configured forbidden-action descriptions are sent to compute semantic-similarity vectors, and OpenAI does not train on API data. Self-hosting ScopeGuard embeddings on our own infrastructure is planned but not yet in production. The in-app support assistant (Scout) uses an LLM on Clevername-paid keys. None of these touch the model that answers your prompts — that always runs on your own provider key.
What we run, every dayContinuous testingMonthly automated red-teamAn automated red-team campaign runs against staging on the first of every month. Findings tracked in-repo, reports published as PRs. The full governed pipeline (including the beta Tier-3 deep scan — which runs on every request for governed agents, not just ambiguous ones; ungoverned traffic only escalates to Tier-3 on ambiguity or a Tier 1/2 disagreement) reaches 94.8% detection on our 310-attack red-team corpus, at a 14.75% false-positive rate on the mixed benign/attack eval (588 total rows). The always-on Tiers 0–2 baseline measured against live traffic is 94.7% / 2.66% FP (see /cleverguard). Tier-3 is Clevername-operated self-hosted governance compute, wired for governed production traffic, and still labeled beta. These are our own internal test sets, not an independent third-party benchmark.
Database postureRLS audit runs nightlyEvery Postgres table on Supabase is checked for row-level security policy presence and correctness via a scheduled GitHub Action. The job fails the deploy if a new table ships without RLS enabled. Covers all production tables.
Supply chainCI gates on dependency CVEsEvery push runs pip-audit (Python) + npm-audit (TS) + Trivy (containers) on Cloud Build. High-severity findings block merge. Recent example: python-multipart 0.0.26 → 0.0.27 bumped same-day for CVE-2026-42561.
Network isolationHub Core is privateCloud Run ingress is restricted to internal-and-cloud-load-balancing via GCP org policy. Browser traffic enters through the Vercel proxy → external HTTPS LB → Cloud Run. Direct *.run.app URLs are not reachable from the public internet.
