Skip to main content

Trust center

This section is for a security reviewer or an auditor. Standards status and Control mapping cite the code and the test or run behind each row. The auditor guide is a procedure you run against your own instance. No page here states a certification or an audit result.

Pages in this section​

  • Standards status lists the OAuth, OpenID, MCP and related requirements one by one, with a status, the source file and the test behind each.
  • Control mapping maps NIST SP 800-207 tenets and the OWASP agentic and LLM risks to the controls PolicyArc ships, and lists the items it has no row for.
  • Reproduce a decision from the audit log exports one decision and evaluates it again with OPA.

Security controls​

Each item below links to the page that shows it.

  • The Admin API takes an admin key in the X-Admin-API-Key header. The policy bundle endpoint takes a separate key in the X-Bundle-API-Key header. Harden an instance lists the secrets the server refuses to start without, and Rotate keys and secrets shows how to rotate each one.
  • Client secrets are stored as BCrypt hashes, so the server shows a secret only once. Register a client shows the response that carries it.
  • A software statement presented at /register has its signature verified by default. PBAC_SOFTWARE_STATEMENT_VERIFY=false turns that off. Register with a software statement shows the check.
  • When the server fetches a client's JWKS, a client ID metadata document, a software statement issuer's discovery document, or an identity provider's discovery document from the Admin API's discovery call, it requires HTTPS, refuses private, loopback and link-local addresses, and does not follow redirects. A statement issuer's keys URL gets the same HTTPS and address check, and the JWT library then fetches it. PBAC_SAFE_HTTP_ALLOW_INSECURE_LOCALHOST relaxes this for listed development hosts and is off by default. The identity provider discovery document and key set fetched during sign-in, and the SPIFFE trust bundle, do not get this check. Managed resource upstreams get the same address check when they are saved and before each gateway call, but they may use http. Standards status gives the test for client ID metadata documents.
  • /introspect callers authenticate with a bearer token that carries the right scope, or with Basic auth. Check a token at your resource server with introspection shows both.
  • The implicit and password grants are not offered, a public client must send a PKCE challenge, plain PKCE is refused, and redirect URIs must match a registered value. Standards status gives the test for each.
  • A client can bind its tokens to a key with DPoP. The managed gateway then refuses the token without a proof from that key. Bind tokens to a key with DPoP shows the binding and a refused proof.

Policy portability​

Policies are Rego, the language of the open-source Open Policy Agent. The rules and the control data are stored as rows the Admin API returns, and the server serves them to the policy engine as a standard OPA bundle. Deploy and roll back policy shows how they are read and written.

Audit log​

The server writes an audit row for its policy decisions, its OAuth errors and administrators' changes. The Admin API reads and exports rows and has no route that changes or deletes one, and neither does the admin UI. Database triggers reject UPDATE, DELETE and TRUNCATE on the audit tables, and a database owner can disable them. The role the server connects as, pbac by default, owns those tables, so the server's own database credentials are enough to do it. The server has no retention setting. Audit log covers each field and the export, and Reproduce a decision from the audit log checks one decision against its policy.

Architecture and deployment​

Architecture and deployment describes a self-hosted instance. It draws the trust boundaries, lists what the instance stores and where, and says what happens when a pod stops. Data handling and Security overview are the pages a security review usually starts from.

Service commitments​

For service levels, data residency and incident response, contact us.