Security data flow

Follow a representative request from the application to its stored evidence and exports. Record which fields cross each boundary and which service receives them.

Repeat the review when capture settings, adapters, deployment configuration, or the proof provider change.

Application to VeriProof

The SDK sends supported telemetry and governed runtime requests to the configured central VeriProof endpoint. An entitled application can route ordinary governance calls through a local Edge Gateway while retaining the same application identity and central endpoint.

The application decides which business facts to submit and how to use the policy result.

Ingest and stored records

The ingest service authenticates the application and validates submitted telemetry. Accepted data is stored in the deployed VeriProof data stores.

Prompt and response content is disabled by default. Enabling it requires a data review and representative redaction test.

Background updates

Background services can create or update:

• governance and compliance views;
• alerts and notifications;
• assigned review work;
• human-review delivery and acknowledgement;
• outcomes and quality records; and
• proof submissions and reconciliation.

These updates can occur after the original ingest request. Compare record identifiers and timestamps before concluding that a delayed view has lost data.

Portal and agent access

The portal, MCP server, and CLI use authenticated user or workload identities. Their application services apply tenant, role, application, and audit scope before returning data or accepting a write.

Evidence export

An export can include selected records, a manifest, redaction information, and available proof references. Check the actual contents before sharing; export formats and scopes differ.

Store and transfer the package according to its data classification. Permission to download it does not authorize disclosure to every recipient.

Proof provider