How it works

From first request to signed audit trail

policy.check passed · 41ms · signed
run 4f21c9 2.4s total
  1. 1

    Point us at your endpoint

    One URL and a signing secret. No agent to install, nothing to run inside your VPC.

    POST /v1/sources

  2. 2

    Write the policy once

    Rules are plain expressions with autocomplete, versioned in the same repo as your code.

    allow if actor.role in ["admin"]

  3. 3

    Dry-run against real traffic

    Shadow mode replays yesterday so you see exactly what would have been blocked before anything is.

    mode: shadow · 1.2M decisions

  4. 4

    Ship it, keep the receipts

    Every decision is signed and exportable, which is the part your auditor actually asks for.

    GET /v1/audit?from=2026-01-01

    Read the integration guide