tovio.DonateSign inEarly access

Evaluation · audit and compliance

“Who read this file?”
should have an answer.

In a conventional repository, read access is invisible: anyone who can clone can read everything, and nothing records that they did. Every control above that layer is compensating for it. TOVIO moves the boundary into the object itself — and this page is explicit about where that stops.

Release gates · as of 2026-08-03Read from the versioned status manifest, not written by hand.

  • General availabilitynot yet accepted
  • Independent security reviewnot yet accepted
  • Counsel-approved legal termsnot yet accepted
  • Hosted servicenot yet accepted
  • Enterprise (Tier-2) evidencenot yet accepted

Phases 0-4 are implementation-complete under their documented profiles. Phase 5 productization, publication, hosted-service, Tier-2 Enterprise, and independent evidence remain in progress.

Control matrix

Three answers, and only one of them is “yes”.

A requirement is either implemented in the system today, gated behind evidence that has not been accepted, or an obligation that stays with whoever operates the deployment. Mixing those three is how procurement questionnaires get answered wrongly.

Restrict who can read a sensitive path

Implemented

Protected paths are encrypted at snapshot time. Content keys are wrapped only for explicitly named recipients, so an unauthorized clone holds ciphertext rather than a policy decision it could ignore.

Produce evidence of who read a protected path

Implemented

Protected reads mediated by TOVIO append to a per-actor signed audit chain, which makes retroactive tampering with the record detectable.

Prove an artifact was not altered in transit or at rest

Implemented

Objects are content-addressed with BLAKE3-256 and re-hashed on read and on receipt; a mismatch surfaces as corruption instead of being served.

Bound what automation may do

Implemented

Capability tokens are scoped by path, lane, operation, expiry, and secret clearance, and are signed by a human authorizer under the repository's own identity. The scope is enforced before a change is sealed.

Attribute a change to a specific non-human actor

Implemented

Provenance is recorded against the stable change ID and survives the supported rewrite operations, so it is still attached at review time.

Keep review from being bypassed

Implemented

Landing passes authorization, protected-lane, review, and integrity checks; the Git bridge path refuses a push that would bypass a required review rather than accepting it.

Attribute-based read control evaluated in the cryptography

Gated

Tier-2 CP-ABE has passed its enterprise Key Authority conformance and internal-review gate, but remains behind private, default-off release boundaries and is not currently available. Threshold, KMS, and HSM authority and live-provider evidence remain open.

Directory sync, SSO, and SCIM provisioning

Gated

Identity federation connectors are commercial components delivered with the enterprise Key Authority train, and follow the same evidence gate above.

Independent third-party assurance

Gated

The independent security and cryptography review has not completed. Until it does, treat the cryptographic claims on this site as vendor claims and verify them against the published specification.

Data residency, retention schedules, and legal hold

Your responsibility

Determined by where you run the Forge and how you operate it. Running it on your own infrastructure puts these entirely in your control; the shared-responsibility page states the split.

Sandboxing agent runners and their network reach

Your responsibility

TOVIO authorizes what an agent does through TOVIO. Isolating the process, the shell it can spawn, and the endpoints it can reach is an operator responsibility.

Rotating live production credentials

Your responsibility

A managed secrets store with short lifetimes remains the right control for a rotating credential. Encrypting it in a repository is not a substitute.

Claims we will not make

The sentences you should be suspicious of anywhere.

  • “Compliant with” a framework. Software is not compliant; a deployment under an operator's controls is assessed. We can tell you which technical controls the system implements, and we do that above.
  • “All reads are logged.” Reads of protected content mediated by TOVIO are recorded. Someone with the plaintext on their disk, a screenshot, or a backup of a decrypted working copy is outside that boundary, as they are in any system.
  • “Audited.” Until the independent review completes, the correct word is “specified” — and the specification is public so you can check it yourself.
  • “Unbreakable” or “zero trust” as adjectives. The threat model states the accepted residual risks for v1 by name. Read it before you decide.

The documents your reviewer will actually want.

Threat modelTrust boundaries and the residual risks accepted for v1, named.CryptographyAlgorithms, tiers, key handling, and the envelope construction.Compliance notesHow the implemented controls map to common requirements.Audit logWhat the signed per-actor chain records, and how to read it.Shared responsibilityThe line between what the product does and what you operate.Security pageDisclosure process, contacts, and current posture.
Security overviewOpen assurance workTalk to us about an evaluation