Enterprise‑grade by design
TrustPlane runs inside your VPC/VNet. Sensitive inputs/outputs never traverse a vendor proxy. We standardize identity, policy, routing, and audit across providers—so you can approve once and reuse across use cases. Target outcomes: ≤ 7 days time‑to‑evidence and ≤ 90 days pilot → certificate-verified production.
Instant redacted downloads (EU AI Act, NIST AI RMF, SOC 2 roadmap, Action Certificate sample) unlock after email capture; signed copies and SIG Lite/CAIQ responses arrive automatically after form submission.
How TrustPlane governs a request
In your VPC • No public ingressApps, agents, or humans send requests through the TrustPlane gateway running in your VPC/VNet.
Identity, residency, budget, and evaluation contracts enforced before any side-effects.
Golden sets, drift monitors, and reviewer feedback captured for every promotion gate.
COSE-signed attestation minted with policy hash, approvals, rollout scope, and telemetry references.
Applications, data stores, and automation hooks verify certificates locally before executing writes.
OpenTelemetry spans stream to Splunk/Datadog for audit, FinOps showback, and incident response.
Controls at a glance
| Mode | Ingress | Connectivity | Use cases |
|---|---|---|---|
| Private | No public ingress; outbound egress optional | VPC/VNet peering only | Regulated workloads, air-gapped environments |
| Private-peered | Private ingress via load balancer | Private link or service endpoints | Hybrid cloud, marketplace procurement |
| Hybrid | Controlled public ingress with IP allowlist | Outbound egress restricted to approved model/tool endpoints | Bring-your-own model endpoints, partner-hosted inference |
Each Action Certificate emits an OpenTelemetry span with identifiers you can query downstream.
span.attributes = {
'trustplane.certificate_id': 'cert_8f24a3d1',
'trustplane.policy_version_hash': 'sha256:9c73…f5a0',
'trustplane.approvals': ['security','finops','data-owner'],
'trustplane.rollout.percent': 25,
'trustplane.learning_contract': 'golden:v1'
};
// Splunk example query
index=trustplane sourcetype=otel span trustplane.certificate_id=cert_8f24a3d1
| stats count by trustplane.policy_version_hash, trustplane.rollout.percent- COSE‑signed, verifiable artifact per action
- Portable across ServiceNow, Snowflake, Slack, Databricks
- OTel → Splunk/Datadog; retention & eDiscovery friendly
- Optional transparency log (append‑only) in your account
We map identity, policy, audit, and certificates into exportable evidence packs for Security, Legal, and Audit.
- • Control mappings with policy version hashes
- • Per‑action lineage + certificate links
- • DPIA/LLM‑risk templates & runbooks
FAQ
Do you run inside our VPC/VNet?
Yes—deployment is in your cloud account so compute and data remain within your perimeter. Private modes require no public ingress.
Do you train on our data?
No—unless you opt in. Model providers and open‑weights are selectable by policy. Routing is vendor‑neutral.
How do you handle secrets and keys?
BYOK/KMS with customer‑managed keys. Reference Terraform & hardening guides help you enforce residency, egress, and IAM scopes.
What artifacts are available for procurement?
SOC 2 program materials, DPIA/LLM‑risk docs, DPA/SCC templates, and Action Certificate samples. Request the full pack below.
Procurement & risk shortcuts
- Security review support (questionnaires, diagrams)
- SOC 2 program / Type II roadmap
- Data residency controls (US/EU), BYOK/KMS
- SIEM streaming (OTel → Datadog/Splunk)