Security model
Protected objects, recipient keys, agent access, verified reads, and explicit limitations.
Read documentA clear view of
what you can rely on.
Start your technical and business review here. Find the controls, operating boundaries, current evidence, and documents that matter for your intended deployment.
Evidence first.
Commitments explicit.
Status comes from the shared release record dated . Internal implementation and testing do not establish public availability, independent certification, or a contractual promise.
- Public release
- Prelaunch
- Downloads
- Not published yet
- Managed hosting
- Not available yet
- Independent security review
- Not complete
Availability is a declared release decision, separate from implementation progress.
Inspect the detailsCheck the download page for accepted artifacts and supported platforms.
Inspect the detailsCloud availability and Enterprise profiles have their own release conditions.
Inspect the detailsPublished specifications and internal tests are different evidence from an independent review.
Inspect the detailsThe documents
behind the decision.
Each link leads to the maintained explanation. Use this directory to navigate the review, then record any unanswered requirements for your profile.
Security & access
Understand the guarantees, the scope of enforcement, and the exposures that remain.
Threat model
Assets, adversaries, assumptions, and the boundary between repository protection and the host.
Read documentAgent authority
Capability scope, expiry, provenance, delegation, and what a token cannot isolate.
Read documentTranscript privacy
Current capture defaults, source selection, sharing, and the limits of observed evidence.
Read documentDeployment & operations
Assign operational responsibility for the profile you intend to run.
Shared responsibility
Separate platform responsibilities from operator, administrator, and endpoint duties.
Read documentSelf-managed deployment
Distinguish the Apache-2.0 engine from a commercially licensed on-premise Forge.
Read documentAudit & compliance
Review available records and evidence boundaries without treating features as certification.
Read documentService status
Check the independent status destination for operational notices.
Read documentCommercial & data review
Read the status notices on each document. A listed page does not make every contract effective or counsel-approved.
Privacy & subprocessors
Review processing disclosures, provider information, and the notices governing their current status.
Read documentData processing addendum
Inspect the DPA and its approval status before relying on contractual data-processing commitments.
Read documentService-level agreement
Check the SLA’s status and scope; do not infer a contracted uptime commitment from architecture.
Read documentLicensing & commercial terms
Understand open-core rights, commercial Forge licensing, and the status of hosted terms.
Read documentAdditional documents: Subprocessors, Terms, Annual agreement, and Acceptable use. Document-specific approval notices take precedence over this directory.
Know where
the boundary sits.
These distinctions should survive every procurement summary, deployment plan, and agent workflow.
- Protected content & metadata
- Policy-protected file bytes are encrypted at snapshot time. Unprotected paths, repository metadata, and authorized plaintext working copies have different exposure boundaries. Read the threat model for details.
- Agent scope & host isolation
- A capability limits TOVIO-mediated operations. It does not sandbox a shell, prevent an agent reading other host files, or constrain its network access.
- Review context & evidence
- Observed transcripts are unattested and self-reported. A cryptographic object address protects recorded bytes; it does not prove that a transcript caused a code change or that an agent’s claims are true.
- Implementation & independent review
- Supported-profile implementation, internal tests, independent review, publication, and service operation are separate evidence states. TOVIO does not claim certifications or reports that have not been completed.
Take a concrete
review into your pilot.
Use the downloadable checklist to record your requirements, findings, and unmet conditions. Include your own evidence requirements before deciding to adopt.
Download plain-text checklist- Who needs to decrypt each protected path?
- What can agents access, and for how long?
- What transcript content may be stored and shared?
- Who operates backups, recovery, keys, and endpoints?
- Which release, audit, contract, and support conditions must be met?
Bring the questions
that decide adoption.
Discuss your intended profile and the evidence your organization needs. Report vulnerabilities through coordinated disclosure.