Trust & security

What Skeg touches, what it cannot touch, and what your security review can verify today — including the parts that are not finished.

Last updated 11 September 2026 · private beta · free, no payment taken

The short version. Skeg runs in your infrastructure. Prompts, completions, source code and audit logs stay inside your network. We receive none of it, so we cannot lose it, sell it or train on it. There is no billing system, no card data and no payment subprocessor.

Where data lives

Component	Runs	Sees
skeg CLI, hooks, endpoint agent	developer machine	your repo and tool config; reports tool names and routing state only
skeg-gate	your network	every model request — redacts secrets and personal data before egress
skeg-authd	your network	email and group membership from your identity provider
Postgres, log store, Grafana	your network	metadata and audit records; no code, no prompt content
Admin app	your machine or cluster	configuration, committed to a private repo you own
Skeg the company	—	nothing from your deployment

Controls you can verify

Egress redaction — secrets, keys, connection strings, card and personal data stripped before any provider call; optional NER; a block mode that rejects instead. A release-blocking canary test proves it on every commit.
Identity — OIDC device flow with your provider, or GitHub/Google/Microsoft restricted to your email domains. Keys expire every 24 hours. SCIM deprovisioning revokes them immediately.
Endpoint control — agent lifecycle hooks block destructive commands, reads of .env and private keys, unapproved tool servers and actions that need a human. Audit-first, enforce when you choose.
Change control — every merge needs a linked spec, a size cap, tests, secret and dependency scans, and human review. Branch protection set at connect time and verifiable with skeg repo check.
Tamper-evident audit — hash-chained append-only logs in the gate, authd, the admin and the endpoint agent, optionally streamed to your SIEM. Verify the chain yourself; a break is detectable.
Isolation — per-project teams, budgets and model allow-lists; NetworkPolicies restrict the gateway to Skeg components and your chosen provider egress.
Evidence on demand — skeg evidence export produces a dated pack mapped to SOC 2, ISO 27001 and 42001, NIST AI RMF and EU AI Act articles, with the audit-chain result and access reviews included.

Supply chain

Every release publishes SHA256SUMS signed keyless with Sigstore, an SPDX SBOM, and GitHub build-provenance attestations for every artifact. Container images are signed with cosign. Both installers verify the published checksums by default and refuse to install a binary they cannot match; the Scoop and WinGet manifests carry the hash, stamped by the release workflow.

sha256sum -c SHA256SUMS --ignore-missing
cosign verify-blob SHA256SUMS --signature SHA256SUMS.sig --certificate SHA256SUMS.pem \
--certificate-identity-regexp 'https://github.com/skeg-dev/skeg/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify skeg-linux-amd64 --repo skeg-dev/skeg

The Go binaries have no third-party dependencies. Images are distroless, run as a non-root user with a read-only root filesystem and all capabilities dropped.

Status of each assurance — plainly

Item	Status
Self-hosted; no customer data reaches us	In place by design
Signed releases, SBOM, provenance	Implemented; produced from the first tagged release
Tamper-evident audit, SCIM, RBAC, HA chart, tested restore	Built and covered by automated tests
Penetration test by a third party	Not yet — scheduled before general availability
SOC 2 Type I	Not yet — evidence sources exist; audit follows first production usage
HA load test and DR game day	Not yet — targets documented in the SLO page
Published uptime for a hosted service	Not applicable — there is no hosted data plane

We would rather you read that table than discover it in procurement. If any row blocks you, tell us and we will give you a date.

Known limits

Browser-based app builders and GitHub Copilot cannot be proxied. Skeg governs them at the repo boundary and through vendor organisation policy; regulated presets disable the builders outright.
Endpoint hooks are enforced by the agent that calls them. A developer with local administrator rights can remove them — the endpoint agent detects and reports that drift rather than preventing it.
fail_mode: open forwards requests when a caller cannot be verified, with degraded attribution. Regulated deployments use closed.

Reporting something

Email security@skeg.dev — acknowledged within one business day, assessment within five. Machine-readable policy at /.well-known/security.txt. Data processing agreement, standard contractual clauses and a completed CAIQ-Lite on request.