EvasLabs
TRBook a demo
Menu
PlatformStudioSolutionsServicesSecurityPricingTake the 3-minute tourTürkçeBook a demo

Every boundary fails closed.

Every person, service and secret is identified and scoped. No certifications are claimed; this is how it is built.

Policy on every callUnknown or unreachable means deny.
Guardrail floorNo customer role can disable it.
Signed releases onlyProduction pushes nothing but rollback requests.
Credentials stay in their zoneEach zone holds its own.
Organizations isolatedRow-level security, per-organization keys.
Tamper-evident auditKMS or HSM signed, verifiable offline.
Your directoryEntra ID, Okta, ADFS or LDAP via Keycloak.
Four-eyesOne setting, every approval kind.
Zero trust, no mesh neededDefault-deny network policies, signed workload identity.
Signed imagesAn SBOM per image, dependencies locked by hash.
Backup and restoreEvery store; restore ends by verifying the audit chain.
Every route has an ownerA test fails if any route lacks authentication.

Two segregated zones. One signed path between them.

Sandbox and Production are separate deployments with no shared database, event bus or API path. The only thing that crosses is a signed OCI artifact in your own registry, and Production verifies each one before applying it.

Sandbox zone (Hub)Author, test, approve
  • Studio, Tests, release approval
  • Own PostgreSQL 16, Redis and PDP
  • Own credential store (sandbox keys)
  • Own audit chain
  • Own OIDC client
  • Roles: viewer, builder, approver, admin
push, signed
Your OCI 1.1 registry
  • Signed release bundle
  • Policy exception
  • Organization access state
  • Knowledge-base corpus
Rollback request
pull, verify, apply
the only thing Production can push
Production zoneRun signed releases only
  • Runtime: leased queue, horizontal workers
  • Own PostgreSQL 16, Redis and PDP
  • Own credential store (production keys)
  • Own audit chain
  • Own OIDC client, step-up MFA
  • Roles: viewer, approver, ops, admin
  • No authoring tools deployed
  • No shared database
  • No shared event bus
  • No API path from Sandbox to Production
  • Credentials never cross
  • Production runs on if the Sandbox is down
Crosses the boundary
Release bundleWorkflow version, compiled policy, capability manifest, output schemas, evaluation summary
Policy exceptionTime-limited, one workflow, one guardrail; revocation always wins
Organization access stateWhich organizations may run, signed per organization
Knowledge-base corpusContent for retrieval, versioned with the release
Rollback requestFrom Production back to the Sandbox, decided there as a change approval
Never crosses
Credentials, keys and secrets
Run data, prompts and responses
Production audit records
User sessions and tokens
Any network call between the zones
Production refuses
An artifact signed for another organization
An older release, unless a signed rollback names it
A registry credential that can do more than push rollback requests

Air-gapped Production? Copy the artifacts across with standard OCI tools. Verification is the same.

Regulatory packs mapped to real enforcement

Each obligation maps to the controls that enforce it, with met or gap read from live checks. There is no “mark compliant” button.

EU AI ActDORAISO 42001SR 11-7SAMABDDK

These packs support your assessment. They are not certifications.

Documents for your security review

  • Security policy and disclosure process
  • On-premises security whitepaper
  • Answers to common security questionnaires
  • Threat model
  • Privacy notice for the console
  • Scope of the third-party penetration test

Found something?

Write to us with how to reproduce it. We acknowledge within two business days and take no legal action against good-faith research.

security@evaslabs.com

See your own workflow governed, end to end.

A 30-minute demo on a workflow from your world. No slides.

Book a demoAsk about services