Security
Written for the person filling in the questionnaire.
Razoo is a governance layer that sits before side effects, so its own posture is the product. This page says what is enforced by construction today, what we do with your data, and what is on the launch plan rather than in the build. We do not list certifications we do not hold.
Enforced by construction
Invariants with a test that fails if the guard is removed.
Each cell names the file in the test suite that pins it. Removing the guard turns the suite red. That is the whole claim; there is no separate policy document to keep in sync.
Confirm is execution
A staged action never executes unconfirmed. The rule that decides execution is machine-checked and pinned by tests, so no forbidden action auto-executes on any path the tests can reach.
tests/envelope-proof.test.ts
Money and legal fields need a person
Any action touching a field or class marked money_legal requires a human, whatever the confidence and whether or not a model is allowed. No envelope, flag, or confidence can override it.
tests/invariants.test.ts
One promotion path
Only one function grants a learned pattern active status, and only after it is certified by replay against your own history. The CLI refuses promotion-bypassing writes. An imported agent starts with no active patterns.
tests/replay-gate.test.ts
Stale authority cannot fire
Authority is bound to the registry entries it depends on and re-checked before any side effect. If those entries have changed, the handler refuses, records the event, and routes the work to judgment. Nothing is dropped.
tests/proof-state-binding.test.ts
Outbox only, at most once
Every side effect leaves through a transactional outbox enqueued with its cause. Missing handlers fail rather than succeed, failures retry then dead-letter, leases expire, and a duplicate delivery of the same confirm runs the side effect once.
tests/reliability.test.ts
Plumbing never calls a model
A plumbing step walks deterministic rungs only. Its residual is judgment or a visible failure, never a model call and never a staged action. With no provider key, no decision is ever recorded as llm.
tests/runtime.test.ts
Connector calls are guarded
HTTPS only. Private and loopback addresses refused before fetch, after DNS resolution. A cross-host redirect makes no second request. Hash drift before drain makes no HTTP call at all.
tests/connector-actions.test.ts
Unsafe keys are stripped
__proto__, constructor, and prototype are dropped at every untrusted boundary: ingest, YAML, chat payloads, human choices, and pattern JSON. Copies use defineProperty. The pollution attack is kept as a test.
tests/ingest.test.ts
No ambient time or randomness
A lint forbids Date.now, Math.random, and an argument-less new Date on any decision path. Rules, kernel, and patterns take their clock from EvalContext, so every decision replays bit for bit.
tests/invariants.test.ts
An internal adversarial pass has been run against the authority mechanism, written as attacks first and kept as regression tests whether or not they succeeded. Attack classes, outcomes, and severity are in the technical review; an independent third-party audit has not yet been performed.
Data handling
Your data stays in your tenant. Every decision explains itself.
Single tenant, by construction
One deployment per tenant is the isolation unit. State lives in SQLite on a volume you own. There is no shared database and no multi-tenant mode to misconfigure.
Secrets encrypted at rest
Connector and provider credentials are stored as AES-256-GCM ciphertext. The key comes from ENGINE_SECRETS_KEY in your environment or a key file the appliance creates with owner-only permissions, never from the database. Plaintext rows are refused on read.
No model call unless policy allows it
Only a reasoning step may call a model, and only the bounded residual leaves the process under a token contract. A missing provider key is a complete local agent, not a degraded one.
No telemetry, and no content ever leaves your tenant
Nothing about your decisions, your traffic, or your machine is sent to us. Licensed installs send a daily licence heartbeat carrying counts only: licence id, installation id, kernel version, and the number of governed decisions this month. Air-gapped customers turn it off and send a signed monthly usage file instead. The payload schema is strict and tested so content can never be included.
Audit that replays
Each decision records its rung, the pattern or rule and its version, the envelope, tokens and cost, and the confirm that allowed it. Patterns keep the WHEN and THEN they were promoted with, so replay uses the snapshot. A missing snapshot is reported, never papered over.
{
rung: "learned",
pattern: "renewal-note",
authority: "valid", // bound to its registry entries, unchanged
envelope: { class: "action", confirm_required: true },
tokens: 0, cost: 0,
confirmed_by: "approver", // named actor, threaded through the kernel and the SDK
eval_now: "2026-09-01T02:14:00Z"
}
# replay it against the current kernel
$ pnpm engine replay-decision <decision-id>
MATCH · same rung, same artifacts, nothing persistedTransport
What an outbound call may do, and what it may not.
Connector actions and MCP tools share one executor. These limits are constants in the policy package, not per-connector configuration.
HTTPS only
DNS-resolved private-address guard
Same-host redirects, capped
Bounded bodies
Secrets by reference
Fail closed on send
On the launch plan
What is still ahead, stated plainly.
Identity, actor attribution, the hash-chained audit log, retention and erasure, approver notifications and four-eyes, and Microsoft 365 are built and described above. Two things remain genuinely ahead: outside verification, and where the smaller tiers run.
Independent third-party audit
A penetration test and a published assessment before general availability. Until then, adversarial testing is internal, and the technical review says so.
Hosted instances for the small tiers
Trial, Solo, and Starter are hosted by us, each customer on its own database rather than a shared table, with data residency stated in the account portal. Appliance and above stay on your infrastructure until the independent audit exists.
Terms, privacy, and a data-processing agreement
These are being finalised with counsel and will be linked here once they are ready. Questions in the meantime go to hello@viabuild.app.
Certifications
None held yet. Here is the plan.
Razoo does not hold SOC 2, ISO 27001, or any privacy certification, and this site does not display badges for them. The controls that exist are pinned by tests and documented in the technical review, which is a stronger claim than a badge and a weaker one than an audit.
The sequence is: the threat model and security questionnaire answers as documents, then the independent penetration test before general availability, then SOC 2 when a customer contract requires it. We will say here when each one exists.
Licence
Proprietary. Packaged software under a commercial licence.
Razoo is proprietary software. Customers receive packaged images and tarballs under a commercial agreement for their tier; the source is never distributed. It is not open source, and we do not use the term.
Packaged, never source
One agreement per tier
The Embed agreement
How it is audited
Disclosure
Found something? It goes straight to the engineering lead.
We acknowledge within two business days and publish the fix with a test that pins it, the same way every invariant on this page is pinned. There is no bounty program today.
What to include
- What you found and which invariant on this page you believe it breaks.
- How to reproduce it: a test in the style of the invariant suite is ideal, a written sequence is fine.
- Whether you want to be credited, and how.
The rest is under NDA.
Architecture, the invariants and the tests that pin them, the threat model, the red-team history, and the performance wall. Shared with design partners and teams evaluating the program.