Don’t trust our audit claims. Verify them yourself.

EU-hosted by default

Supabase Frankfurt (eu-central-1). US region planned, not default.

Append-only events table

Cryptographic source of truth. Convenience tables are projections.

SHA-256 hash chain

Verifiable by you via SELECT * FROM pliuz_verify_chain()

Incremental Verification O(ΔN)

Scale audit verification to millions of events via signed Ed25519 chain anchor checkpoints.

CSA STAR Level 1 Self-Assessment

Complete CAIQ v4.0.2 responses mapped directly to code in docs/compliance/csa-star-level-1-caiq-v4.md.

EU AI Act Technical File (Articles 12–15)

Compliant logging, transparency, four-eyes human oversight, and Ed25519 tamper-proofing.

Four-Eyes Principle (Segregation of Duties)

Database RPC and domain layer enforce that originators cannot approve their own requests.

Hot Kill Switch & Shadow AI Discovery

Instant 31ms agent isolation (HTTP 423 Locked) and automated zombie/unowned key detection.

Versioned Signing Key Registry

Temporal semi-open intervals [valid_from, valid_to) preventing time-travel signature attacks.

RLS on every table (19/19)

Row-level security on all 19 public base tables; deny-by-default for anon/authenticated, backend service_role paths stay tenant-scoped.

No LLMs in the critical path

Policy evaluation is deterministic JSONLogic. Your payload never touches an external model.

SDK-side redaction

@gated(redact=[...]) and gated({ redact: [...] }) send masked fields to Pliuz. We never see the original.

Per-event auto_approve_source

Every audit row says exactly what allowed the action — policy, tool_flag, standing_grant, or a named human.

Right-to-erasure without breaking the chain

Tier-based retention nulls raw PII and on-demand tenant erasure wipes personal data — the hash chain stays verifiable because it stores hashes of the arguments, not the raw arguments.

Management API on least-privilege machine tokens

Scoped plm_live_ tokens provision agents, policies, and tools — they never run approvals nor mint agent keys, and every write is attributed via acted_via in the audit trail.

Strict CSP, nonce per request

Content-Security-Policy with a per-request nonce on every response — no inline-script execution from injected markup.

Liveness endpoint at /api/v1/health

Unauthenticated health check for your uptime monitoring — no tenant data, no side effects.

Sub-processors listed publicly

Supabase (EU), Vercel (EU), Resend (EU), Cloudflare, Slack, Google Analytics (marketing site only) — at /legal/subprocessors

DPA at /legal/dpa

Template available on request; signature pending counsel review and entity formation.

Encryption at rest AES-256-GCM

Bound per tenant (AAD = tenant_id), so an encrypted blob cannot be reused across tenants. TLS 1.3 in transit, no exceptions.

No training on customer payloads

No payload inspection for "product improvement". No retention beyond your configured policy.