What we guarantee today, control by control.
Governance that will not submit to its own bar is a presentation. Here are the controls your security team assesses, in clear and verifiable terms.
Security documentation cannot go stale quietly.
Every vendor promises its compliance material is current. Here, three documents are tied to the code by test: if the code changes and the text does not follow, the build fails.
Public API contract
Document and code are guarded against drift. Editing one without the other fails CI.
Conformance report
Generated by command, never hand written. Editing the file by hand fails CI.
Retention and data
The list of append-only tables is derived from the migrations. A new table missing from the document fails CI.
It is the product thesis applied to our own material: the rule stops being a document and starts being executable.
The controls your vendor review asks for.
What we govern, control by control: access, authorship, authority, trail and data handling. It is the map your security team uses to assess the platform.
Ungoverned periods are on the record
When the gate cannot ask, it lets the write through, and that passage is marked as ungoverned, with the cause kept separate: timeout, server unreachable, bad response, or incompatible version. A day without control does not look like a governed day in the trail.
Immutable decision trail
Append-only record with author, authority and basis per decision.
Credential separation between person and agent
Approving a spec, failing quality and merging require a person credential, verified at the source.
Scope barrier in the editor
Guard stops the agent from writing outside the card approved for the branch.
Drift analysis between spec and diff
Judge writes on the PR itself where the delivery drifted from what was approved.
Hardening against instruction injection
Untrusted content in the analyzers is treated as data, never as instruction.
Codebase indexing
An architectural choice: h|ve does not index your code. What travels is metadata, spec and diff.
The full detail of each control, with evidence and owners, comes in the security review run together with your team.
What leaves your environment, and what never does.
The choice that unblocks security review the most is architectural: h|ve does not index the codebase. Guard checks scope inside the editor, without sending a file.
- What travels
- Flow metadata, the approved spec and the PR diff. The content of your code files stays in your environment.
- What is retained
- The decision record, the gate artifacts and the durable notes anchored to entities. Code content is not retained.
- For how long
- The trail is append-only and stays for the contracted audit period. Operational metadata follows the retention policy agreed in the contract.
- Where it is processed
- In infrastructure in the region defined in the contract. Language inference comes in through a port with an adapter per vendor: today a primary provider and a secondary one, which takes over when the primary is unavailable. Both are declared in the sub-processors.
Person and agent, one credential apart.
A person and an agent are the same worker primitive. What distinguishes one from the other is the credential it presents and the set of transitions that credential authorizes.
Approving a spec, failing quality and merging to the main branch are person-only transitions, with a person credential, verified at the source. No agent credential runs them.
Where there is an override, it belongs to the architect, available by decision and always with a recorded justification. Convenience goes up, and the proof of who decided goes up with it.
Segregation of duties, held by the assignment and scoped to the project. Behavior and data are two different classes of error, which is why there are two independent sign-offs: quality and data integrity. The right to sign does not come from a job title, it comes from the person assignment to that project, granted and revoked by a recorded act, with author and date, in an append-only history.
Competence is per project, never an attribute of the person. Someone who signs for data on one project does not sign on the others, and the screen shows it that way rather than showing the union. And there is a floor: nobody gives up competence unless someone else can still sign, and the rule holds at both doors, revoking and removing from the project.
A trail that only appends.
Every decision enters the record with author, authority and basis, plus the AI-use declaration per delivery. The record is append-only: nothing is overwritten, nothing disappears.
The trail is queryable and exportable: you retrieve who decided what, with which authority and on what basis, and take the record out when an audit asks.
It is the same record the platform uses internally. The convenience of automation goes up, and the proof of every crossing goes up with it.
A hidden instruction in data does not become a command.
Judge reads the approved spec and the PR diff. That material carries untrusted content: issue text, third-party code, a pasted comment. All of it is treated as data to analyze, never as instruction to follow.
The analyzer is hardened against instruction injection: a sentence hidden in a comment asking it to ignore the rule or approve the drift does not change the analysis or the verdict.
On uncertainty, the behavior is to flag, not to act. Judge flags and records; the one who decides is still the person at the gate.
If the failure is ours, the action goes back to you.
What h|ve counts is your plan allowance, and it is consumed when the action starts, not when it succeeds: the model call has already gone out. When the work is not delivered because of a failure on our side, the action goes back to your allowance.
The token never passes through h|ve. The LLM key is yours, and the call shows up on your provider invoice with the same timestamp as our record, so the two sides reconcile line by line.
The rule came from a real, recorded incident: the founder paid for an action lost to a server error and got nothing for it.
Who else touches the flow.
The named, current list of sub-processors is delivered in the security review and kept up to date for contracted customers. Below are the categories and what each one processes.
- Language-model provider
- The language-inference provider that processes the approved spec and the diff. It does not receive the content of your codebase.
- Hosting and compute
- Cloud infrastructure, in the region defined in the contract. It does not receive the content of your codebase.
- Transactional email
- Invitations and flow notifications. No code content or sensitive data in the body.
Take this into your security review.
A short conversation with the people who build the platform, to answer your vendor questionnaire, control by control, with evidence.