Security overview

ThumbGate · Last updated: 2026-08-18 · JSON: /security.json

Control layer model

ThumbGate provides pre-action control for AI agents: allow, warn, require approval, or hard-deny tool calls based on configured rules. It is not a guarantee that every unsafe action is detected.

Local-first boundary

The default local engine keeps workspace source and local lessons on your machine. Hosted surfaces process account, billing, device pairing, and runner operational logs as described in the Privacy Policy.

Vendor questionnaire

Standard startup security-review questions, answered from existing public docs. Copy the JSON or the markdown block below.

Copy as markdown

# ThumbGate security questionnaire

Updated: 2026-08-18
This is not a SOC 2 report, pen-test certificate, or compliance certification.
Machine-readable: https://thumbgate.ai/security.json

## What does ThumbGate do?
ThumbGate is a local-first pre-action control layer for AI coding agents. Gates can allow, warn, require approval, or hard-deny tool calls. It is not a guarantee that every unsafe action is detected.
Source: /security and docs/legal/SECURITY_AND_INCIDENT.md

## Do you have SOC 2, ISO 27001, ISO 42001, HIPAA, or a default BAA?
No. ThumbGate does not have a SOC 2 Type I/II report, ISO 27001 or ISO 42001 certificate, HIPAA eligibility, or a default BAA. Do not treat marketing “control mapping” language as an attestation.
Source: docs/legal/SECURITY_AND_INCIDENT.md §7

## Where does customer workspace source code live?
On the customer machine by default. The local engine does not fetch or render workspace source on public marketing dashboards. Hosted surfaces process account, billing, pairing, and runner operational logs — not local workspace contents unless the customer sends them.
Source: /privacy and docs/legal/PRIVACY_POLICY.md §1–2

## Do you train models on customer data?
We do not share local-engine workspace source with model trainers. Hosted features only process content the customer sends to those features.
Source: docs/legal/PRIVACY_POLICY.md §3

## Who are your subprocessors?
Operational list: Stripe (payments), Railway (hosting), Plausible (web analytics), PostHog (product analytics where configured), Resend (transactional email where configured), PayPal (alternate payment rail where used), GitHub (repo/issues/Marketplace). Presence on the list is not a claim that every enterprise questionnaire or SCC is complete.
Source: docs/legal/PRIVACY_POLICY.md §4

## Is data encrypted in transit?
Hosted endpoints are served over HTTPS/TLS. This is engineering practice, not a certified control.
Source: docs/legal/SECURITY_AND_INCIDENT.md §3

## How is hosted access controlled?
Sensitive hosted routes use API keys or operator auth. Stripe webhooks are HMAC-verified. Production secrets live in the host secret store, not git.
Source: docs/legal/SECURITY_AND_INCIDENT.md §3

## What audit artifact exists for a consequential agent action?
A signed broker execution receipt. Agents cannot mint a valid signature. Public schema: https://github.com/IgorGanapolsky/ThumbGate/blob/main/config/schemas/broker-execution-receipt.schema.json
Source: docs/BROKER_EXECUTION_RECEIPTS.md

## Do you honor Global Privacy Control, DNT, and CCPA 1798.135?
Yes on marketing surfaces. Sec-GPC: 1 or DNT: 1 discards first-party /v1/telemetry/ping (still 204) and omits Plausible/GA bootstrap. Privacy notice describes analytics as pseudonymous, not anonymous, and exposes Your Privacy Choices.
Source: /privacy#your-privacy-choices and PR #3514

## Do you sell personal information?
No.
Source: docs/legal/PRIVACY_POLICY.md §2

## How do we delete hosted account data?
Email privacy@thumbgate.ai or the contact on /privacy. Verified hosted-account deletion requests are processed within 30 days except legal holds. Local data is deleted by removing local directories.
Source: docs/legal/PRIVACY_POLICY.md §6

## What is the incident notification target?
For enterprise customers under a signed agreement that includes incident terms: notify the designated contact within 72 hours after confirming a personal-data or confidential hosted-content breach affecting that customer. Self-serve users without that schedule get commercially reasonable notice, not a contractual 72-hour SLA.
Source: docs/legal/SECURITY_AND_INCIDENT.md §5

## How do we report a vulnerability?
Email security@thumbgate.ai with “Security” in the subject. Do not file public GitHub issues for active vulnerabilities. Acknowledgement target: 48 hours.
Source: /security

## Can we inspect the control layer?
Yes. The public runtime is MIT-licensed at https://github.com/IgorGanapolsky/ThumbGate. Hosted operation, adapter coverage, and dashboard state are what a subscription buys — not a private intelligence split.
Source: MOAT.md and /legal/licensing

## How do we verify the live hosted build?
GET https://thumbgate-production.up.railway.app/health returns version and buildSha. Production claims require that buildSha to match the intended main commit.
Source: CLAUDE.md Deployment Verification Gate

Incident notification posture

For enterprise customers under a signed agreement that includes incident terms, the draft contractual target is notification within 72 hours after confirming a personal-data or confidential hosted-content breach affecting that customer.

Vulnerability disclosure

Email security@thumbgate.ai with “Security” in the subject. Do not file public issues for active vulnerabilities. Acknowledgement target: 48 hours.