Local-first processing
Scan, policy evaluation, and evidence storage default to the macOS endpoint.
Security · Privacy · Trust
Security whitepaper
Architecture-level security and privacy controls for enterprise review. Extends the Trust Center with threat model, cryptography, access control, and known limitations. Pilot-ready — not Enterprise GA.
Security principles
Metadata-only credentials
Provider, storage type, and fingerprint — never raw API keys or tokens.
Evidence separation
localRawEvidence never uploads; sharedOrgEvidence is signed and allowlisted.
CoverageGap-first
Missing data is explicit — no silent pass or implicit fallback.
Cryptographic integrity
Hash-chain journal with encrypted journal payloads; Ed25519 signed exports. Journal payloads are encrypted; inventory tables are metadata-only but not encrypted in the current release.
Explicit consent
Keychain and sensitive sources require machine-verifiable approval.
Source-attributed assurance
Every external policy or enforcement outcome must identify the product that acted; BeProof findings never imply blocking.
Trust boundaries
Two-tier model: macOS endpoint (Tier 1) and org governance plane (Tier 2). Policy evaluation stays on the endpoint. Automated upload path carries sharedOrgEvidence only — signed, allowlisted, tenant-scoped. localRawEvidence (SQLite, full reports, journal bodies) never transits the upload API.
MDM delivers install and org-policy overlay in parallel — BeProof does not replace MDM, EDR, or SIEM.
External control evidence, when an adapter is available, is an independent input. It remains bound to its source product, source event ID, collection time, freshness, confidence, privacy class, and transformation chain. Missing or unhealthy adapters create a CoverageGap.
Provenance and transformation chain
Action, policy-decision, enforcement, and evidence-link contracts preserve the originating product and record, collector identity and version, collection and ingest times, runtime reference, confidence, privacy class, and each normalization step. Links are labelled causal, correlated, or missing; provider or path similarity alone cannot be promoted to causal evidence.
A redacted multi-source contract fixture demonstrates an external enforcement event alongside explicit missing credential and tool links. The fixture uses placeholder manifest values for schema validation; only endpoint-generated bundles are expected to pass cryptographic verification. See the incident bundle verification contract.
Threat mitigations
| Threat | Primary mitigation |
|---|---|
| Secret exfiltration via cloud | Metadata-only upstream; ingestion denylist rejects raw secrets and DB paths |
| Forged fleet summary | Ed25519 signature verified against enrolled device key registry |
| Tampered local evidence | Append-only hash chain — verify-journal detects seq and hash breaks |
| Cross-tenant admin access | tenantId scope + RBAC on API and UI; integration tests deny cross-tenant reads |
| Tampered release artifact | Signed, notarized DMG + verify-install + published SBOM/provenance |
| Keychain scan without approval | Consent ledger (POL-G02) in addition to TCC/PPPC where applicable |
| Missing or stale collector treated as clean evidence | Source health + freshness + CoverageGap; no silent fallback to pass |
| External block attributed to BeProof | Explicit EnforcementEvent, enforcedBy, source event ID, and provenance required |
Cryptography
| Domain | Algorithm | Scope | Key material |
|---|---|---|---|
| Journal at rest | AES-256-GCM (aes-256-gcm-v1) | evidence_journal.payload_json | Keychain per database path |
| Export / fleet signing | Ed25519 (ed25519-v1) | Export, fleet, and incident evidence manifests | Keychain export-signing |
| Transport | TLS 1.2+ | Endpoint API, admin UI, cloud connectors | Platform / HTTPS |
| Cloud SQL | GCP platform encryption | Tenant governance metadata | Google-managed (pilot) |
Journal payloads are encrypted; inventory tables are metadata-only but not encrypted in the current release.
Verify CLI
Five non-interchangeable commands. GRC recipients without the Mac use verify-export-manifest. Auditors on the scanning endpoint add verify-journal. Incident recipients use verify-incident-bundle without requiring the endpoint database.
| Command | Proves | Local DB |
|---|---|---|
beproof verify-journal | Hash chain, seq continuity, journal encryption status | Yes |
beproof verify-export | Signature + manifest + journal linkage | Yes (linkage) |
beproof verify-export-manifest | Artifact SHA256, manifest hash, Ed25519 signature | No |
beproof verify-install | App signature, notarization, provenance/SBOM | No |
beproof verify-incident-bundle | Incident artifact SHA256, manifest hash, and Ed25519 signature | No |
Access control (pilot)
Admin console
Firebase email/password (pilot). Roles: org_admin, security_analyst, fleet_admin, auditor_readonly. SAML/OIDC enterprise IdP — post-GA.
Fleet enrollment
One-time admin-issued tokens. Device JWT at enroll, bound to tenant. Personal mode cannot fleet-enroll.
Release trust (POL-X13)
Overall control status: Partial — public pipeline is shipped; enterprise release controls remain on the Enterprise GA roadmap.
Public release pipeline (shipped)
- Signed and notarized macOS DMG from public GitHub releases
- SBOM and provenance published alongside each release
- CI gate: beproof verify-install on release artifacts
- Managed endpoints: Sparkle disabled when org overlay present — MDM PKG authority
Enterprise release controls (partial)
Fleet-wide verify-install attestation in control plane, tenant-private or air-gapped artifact mirror, org-enforced minimum release version policy, and automated MDM promotion workflow — manual MDM runbooks today.
Known limitations
Security review should explicitly accept these residual risks:
- Partial cloud visibility without configured provider admin APIs
- Journal payloads are encrypted; inventory tables are metadata-only but not encrypted in the current release.
- Root on an unlocked Mac defeats Keychain-bound keys
- Evidence and reporting only — no runtime blocking of AI agents
- Production external policy and enforcement adapters remain planned; contract fixtures are not live customer telemetry
- Pilot cloud: shared tier, no CMEK, best-effort uptime
- Apple Silicon (arm64) only — Intel not supported
Security review checklist
- Accept metadata-only upstream model (sharedOrgEvidence allowlist)
- Confirm MDM overlay and PPPC for pilot ring
- Validate consent model for keychain-inclusive scans
- Confirm verify CLI workflow for GRC handoff
- Review tenant isolation and admin auth model
- Review retention and subprocessors in Procurement FAQ
- Document accepted residual risks above