How Ethen keeps work contained
How Ethen separates work, applies rules, handles secrets and takes security reports.
How Ethen Platform is designed to control access, apply policy, keep humans in charge of consequential actions, isolate computer use and handle secrets, and what we do not claim.
Security is owned by Ethen Platform, with Sentinel as its policy layer.
Select a layer
- Tested in development
- Implemented in development
- Design rule
The Platform console is gated, and Gateway access uses keys.
Gateway evidence ladder in the registry: Implemented.
Read more about access01Claims by evidence
Each claim, with its evidence level
Layer
What we claim
The Platform console is gated, and Gateway access uses keys.
Gateway evidence ladder in the registry: Implemented.
Evidence level
Implemented in development, level 2 of 4Layer
What we claim
Sentinel evaluates fixture policies with the open-source Cedar engine, in development.
Fixture level only. The validation script's results have not been re-run for this page.
Evidence level
Implemented in development, level 2 of 4Layer
What we claim
Consequential actions in supported workflows go to the Platform approval service, and receipts record the outcome.
Supported workflows only. Founder missions fail closed.
Evidence level
Implemented in development, level 2 of 4Layer
What we claim
Computer runs in its own sandboxed worker with an egress guard and lease checks, apart from Chat and other products.
Test suites ran in development; results have not been re-run for this page.
Evidence level
Tested in development, level 3 of 4Layer
Secrets
What we claim
Provider keys and connector credentials are kept on the server side and are not sent to browsers. This is a design rule; it has not been independently tested.
Not independently tested.
Evidence level
Design rule, level 1 of 4Layer
What we claim
Receipts record what was approved and what ran.
Not established as complete or forensic-grade; not independently audited.
Evidence level
Implemented in development, level 2 of 4Layer
Independent review
What we claim
An independent security audit or penetration test of the Platform.
No independent security audit or penetration test has been published.
Evidence level
None published, no level reached
02Limits
Not done yet, and not claimed
Planned
- Policy coverage for real Platform flows. Today policies run only in fixtures.
- A managed vault for Flow connector credentials, shared by every product.
Limits
- UpCube is not certified against any compliance standard: we hold no SOC 2 report or similar certification, and nothing on this page is a compliance claim.
- No independent security audit or penetration test has been published.
- We have not published a test of how customer workspaces are kept apart, and make no claim beyond what this page lists.
- Not available for general use; nothing here is a release promise or date.
03Reporting
Report a security issue
Use the contact page and describe the issue, with steps to reproduce it if you can. The security statement in our legal pages explains how we handle reports.
04Questions
Questions
01Do you hold SOC 2 or similar?
No. UpCube is not certified against any compliance standard and holds no SOC 2 report or similar certification.
02How do I report a vulnerability?
Use the contact page and describe the issue. The security statement in our legal pages has more detail on how we handle reports.
Status and related pages
Security is owned by Ethen Platform. We describe what is built and tested, and claim nothing more.