Six frameworks. One infrastructure.
Live badge status pulled from /api/compliance-badges. Color reflects current observation state, not aspiration.
Type II proves the design operates correctly over the 180-day observation window, not just that it was designed correctly. Scope: security, availability, confidentiality. Audit start: Jan 1 2026. No shortcuts, no vendor attestations.
Every compliance record is written to an append-only, HMAC-SHA256 signed table. PL/pgSQL triggers block UPDATE and DELETE at the database level — no application path to mutation exists. 7-year retention enforced. Designed for RIA, broker-dealer, and CCO use.
Customer NPI is never stored in cleartext. AES-256-GCM encryption at rest, TLS 1.3 in transit. Breach notification procedure documented with 30-day reporting target. Data Processing Agreement available on request.
Article 14 human oversight: hallucination-blocked events recorded, budget exhaustion stops intent. Article 15 accuracy: MARCH verification gate + adversarial regeneration. Article 12 logging: WORM append-only audit trail. Enforcement: Aug 2 2026.
PHI never processed without explicit BAA. Per-tenant data isolation enforced at query level — no tenant can access another's data. Access audit log captures every PHI read. BAA template available on request. Healthcare state layer: WA MHMD, TX HB 300, 21st Century Cures Act.
ML-KEM-1024 (CRYSTALS-Kyber), ML-DSA-87 (CRYSTALS-Dilithium), SLH-DSA (SPHINCS+) deployed per NIST FIPS 203/204/205. Quantum-safe signature infrastructure is live in the audit chain. No dependency on RSA-2048 or ECDSA for audit integrity.
Live, not screenshots.
Every indicator below pulls live data. If anything is degraded, it shows here.
How verification actually works.
No black box. Three steps, cryptographic proof at each boundary.
PL/pgSQL triggers block UPDATE/DELETE on compliance_audit_log at the database level. Not configuration — code enforced by the database engine itself.
The Five Shields are not aspirational. They are live infrastructure.
Sturna's architecture maps to the three principles of Tria Prima: Sulfur (ethical intent — the CMAG constitutional layer and COMBINED_ALERT override), Mercury (agent mesh — the 201-agent competitive mesh that self-organizes via Shiva Protocol), and Salt (infrastructure — the immutable audit trail, WORM enforcement, and HMAC-signed context manifests). Every compliance claim on this page traces to one of these three layers. The shields are not features. They are the enforcement mechanism that makes the claims credible.
GET /api/trust/audit-stats
Every audit entry carries a deterministic canonical payload signed with HMAC-SHA256. PL/pgSQL triggers block UPDATE and DELETE at the database level — there is no application-layer path to mutation. Verification is server-side: GET /api/trust/audit-stats recomputes HMAC for every entry on read. A mismatch is a production incident.
GET /api/live-metrics/context-integrity
Every multi-agent decomposition produces a context manifest. The manifest must be acknowledged (manifest_ack) before the next phase begins — this is a hard block, not a warning. Context leak detection runs in parallel; any cross-boundary data exposure triggers an immediate critical block and audit event.
GET /api/live-metrics/consistency
The Transitive Consistency Verifier triangulates agent outputs against source state. Triangulation hashes track clause-level divergence; sessions exceeding the divergence threshold (0.35) are flagged for human review. GAN discriminator queued for Week 3 rollout — currently handled by consistency threshold as the active defense.
8ef70830d298d95580563f0c4c0ff0c8 active | 5 sessions monitored | divergence threshold 0.35
/demo/live-bidding
HIGH-criticality findings trigger a mandatory human-in-the-loop gate. The Transparency Card shows all 5 confirmation fields: intent classification, agent identities, scoring rationale, execution output, and audit signature. The human review path is not a suggestion — it is a hard stop on the execution pipeline.
/demo/live-bidding | AuditLogger HMAC-signed entries | Human review path enforced at pipeline level
The COMBINED_ALERT mechanism fires when consumer harm indicators are detected. It immediately pauses the current execution and opens a competing auction on ethical grounds. The override is not configurable — it is constitutional, hard-coded into the CMAG layer. Current status: mechanism is wired and deployed. Internal dogfood testing in progress before general availability.
Security architecture
Current cryptographic and infrastructure configuration. Claims link to implementation.
| Control | Implementation | Status | Evidence |
|---|---|---|---|
| State encryption | AES-256-GCM, 12-byte random IV per operation | Active | src/lib/secure-sturna-checkpointer.js |
| Audit log signing | HMAC-SHA256, deterministic canonical payload, verified on every read | Active | src/lib/audit-logger.js |
| Post-quantum key exchange | ML-KEM-1024 + AES-256-GCM hybrid · 0.98ms avg perf | Active | src/lib/secure-sturna-checkpointer.js §PQ |
| Zero-trust agent tokens | HS256 + per-tenant HMAC rotation (30d) · 5-min TTL | Active | services/zero-trust-token-service.js |
| Audit log immutability | PL/pgSQL trigger blocks UPDATE/DELETE on compliance_audit_log | Active | migrations/046_*.js |
| Tenant isolation | Per-tenant Redis key prefix · cross-tenant throw + audit event | Active | src/lib/redis-checkpointer.js |
| Key versioning | keyVersion field on every STATE_SAVED event · rolling rotation | Active | audit log keyVersion field |
pilot_workspace_members table · updates on page loadCompliance program status
Real status. Observation period started 2026-05-03. Type II requires 90–180 days of operating evidence. Not complete — target Q4 2026.
Observation started 2026-05-03T07:40:00Z. The security architecture (Type I — design) is complete. Type II proves it operates correctly over the observation window. No certification exists yet — this tracker reflects where we actually are.
Verify Audit Chain
Paste any Sturna thread ID from a Transparency Card or audit log reference. Server-side HMAC recomputation proves chain integrity without exposing keys. GRC reviewers: download the PDF report to attach to your audit file.
Audit log health
Real-time aggregates from the live compliance_audit_log table. Cached 5 minutes. Integrity score below 100% would be a production incident.
Article-by-article attestation
Sturna maps its architecture against EU AI Act Articles 10–15 (High-Risk AI obligations). Full Article-by-Article analysis available at the readiness tool. Below: Sturna's own posture on each key obligation.
ComplianceClassifier tags PII/MNPI inline. Hard MNPI reject. Per-tenant data isolation enforced.
Architecture doc + data-flow diagram drafted. Formal Annex IV package in progress.
Append-only HMAC-signed audit log. WORM enforcement. 365-day retention. SEC 17a-4 aligned.
Triple-Gate verification. GSAR grounding. Citations traced to source on every output.
Hallucination-blocked events recorded. Budget exhaustion stops intent. Human review path available.
MARCH verification gate. §13A GSAR adversarial regeneration. Post-quantum crypto. Self-healing router.
EU AI Act Articles 10–15 enforcement begins Aug 2, 2026. All operators of High-Risk AI systems in regulated verticals must demonstrate conformity before that date.
Last 90 days
No greenwashing. Dips included, fixes documented.
Downloadable due-diligence materials
Standard enterprise procurement documents. Current status noted. Email security@polsia.app for the complete ZIP or to request a security questionnaire.
Live audit evidence bundle: GET /api/compliance/evidence-export/bundle (admin key required).
Formatted for Drata Custom Connection daily pull.
Actual list, actual regions
Every service that processes tenant data. No omissions.
| Sub-processor | Purpose | Data region | Data type processed | DPA |
|---|---|---|---|---|
| Neon | Primary database (PostgreSQL serverless) | US-East (AWS us-east-1) | Intent data, audit log, tenant config | Available |
| Render | Compute / hosting | US-West (Oregon) | Application runtime, env secrets | Available |
| Upstash Redis | Encrypted state storage (per-tenant) | US-East-1 | AES-256-GCM encrypted agent state | Available |
| OpenAI (via Polsia proxy) | LLM inference | US (OpenAI data centers) | Intent text, agent prompts (no PII policy enforced upstream) | Pending |
| Polsia (proxy) | OpenAI proxy routing & cost tracking | US | LLM request routing (no content storage) | Available |
| Stripe | Payment processing | US | Payment metadata only — no financial instrument data stored | Available |
| Postmark | Transactional email | US | Email addresses, notification content | Available |
All tenant data remains in US regions. No cross-border data transfer to EU/EEA at this time. EU tenants requiring data residency in-region: contact us — roadmap item Q4 2026.
CCOs and GRC reviewers closing the June 3 RIA pilot round get a dedicated compliance walkthrough. We cover your specific regulatory obligations — not a generic demo.