Independent penetration test by Pentx Security (April 7-14, 2026) — 182 tests across 9 attack categories, 0 critical and 0 high findings. CI-gated threat detection at 100% precision on the 241-sample test corpus. Hash-chained audit log with 7-year WORM retention.
When you secure APIs, AI agents, LLM traffic, and deploy plugins — you need to trust the security platform itself
Your Security Tool is an Attack Vector
Every security platform you add to your stack becomes a potential target. If your API security gateway is breached, attackers have full visibility into your APIs and can disable protections.
Black Box Trust Problem
Most security vendors ask you to trust their infrastructure without visibility. You don't know who has access to your logs, how data is encrypted, or if compliance controls actually work.
Vendor Lock-In Risk
Cloud-only security platforms create single points of failure. If the vendor has an outage, your APIs go down. If they change pricing, you're stuck. If they shut down, you lose everything.
Independently Verified Security
External pentest by Pentx Security (April 2026): 0 critical, 0 high, 3 medium remediated across 182 black-box tests. CI baseline enforces 100% precision and 87.96% recall on every commit — regression fails the build.
HMAC-Keyed Hash-Chain Audit
Audit log entries chained with HMAC-SHA256 + deployment secret — not raw SHA-256. An attacker with database access still cannot forge a valid chain entry without the key. 84-month WORM retention. Three verification levels (full chain, single entry, last-N).
Self-Hosting Available · No Lock-In
Run G8KEPR as SaaS or deploy on your own infrastructure via Docker containers and Kubernetes Helm charts. Export all data anytime in standard formats (JSON, CSV). Built on open standards (REST, OAuth, JWT) for portability.
Production-ready security features protecting your APIs and AI agents
AES-256-GCM and ChaCha20-Poly1305 cipher suites. TLS 1.2 explicitly disabled. mTLS for internal service-to-service traffic.
Application-level encryption for API keys, OAuth secrets, TOTP, webhook secrets, MCP secrets. 96-bit nonce per operation, 128-bit auth tag.
PBKDF2-HMAC-SHA256 with 600,000 iterations (OWASP 2024). Passwords use bcrypt at cost factor 12+. Timing-safe comparisons everywhere.
Each entry signed with HMAC-SHA256 + deployment-specific key. Genesis block derived from the key itself. DB access alone cannot forge a valid chain entry.
90 days hot in PostgreSQL (monthly partitions), 7 years cold in S3 with Object Lock COMPLIANCE mode. 10-20x throughput from batch writes.
Full-chain verification (every entry), single-entry spot check, and last-N rapid integrity check. Detect any retroactive modification by recomputing hashes.
Every merge gates on CodeQL, Bandit, Trivy, pip-audit, npm audit, OWASP ZAP, Gitleaks, and Semgrep. Build fails on any new finding.
JWT_SECRET rotates every 90 days, ENCRYPTION_KEY every 1 year. Decryption keeps previous key as fallback so rotation is zero-downtime.
Black-box external test by Pentx Security across api.g8kepr.com, app.g8kepr.com, and g8kepr.com. 182 tests across 9 attack categories.
A 241-sample test corpus (191 attacks + 50 benign) is checked into the repo. Every commit runs the corpus through the detection engine. The build fails automatically if precision drops below 100% or recall drops below 87.96%.
Each STRIDE category mapped to a concrete platform mitigation, not generic hand-waving:
Building towards comprehensive compliance with transparency
2,000+ controls mapped across 14 compliance frameworks. Every audit-log entry, every rate-limit event, every policy decision is mapped to specific control IDs — auditors get exports, not spreadsheets. Maturity language follows the data-room baseline (March 2026).
G8KEPR provides the technical controls and evidence — your auditor issues the certification. The maturity labels above match our internal data-room baseline. Below is what we will and will not say about ourselves until attested by a third party.
Third-party verification of our security posture
Full report available under NDA. Contact security@g8kepr.com
Public key pinning
The G8KEPR cosign public key fingerprint is published in our sensor documentation so customers can independently verify all pattern packs.
Secure your security platform
Independent black-box pentest by Pentx Security (April 2026): 0 critical, 0 high across 182 tests in 9 categories. Next test scheduled Q3 2026 with expanded scope (auth dashboard, API key lifecycle, billing). Findings published, not hidden.
Detection precision is enforced at 100% on every commit — regression below that, or below 87.96% recall, fails the build. Plus 8 security scanners (CodeQL, Bandit, Trivy, pip-audit, npm audit, OWASP ZAP, Gitleaks, Semgrep) gate every merge.
Enterprise security controls built-in: TLS 1.3 + AES-256 encryption, RBAC with MFA, tamper-proof audit logs, real-time monitoring, Sigstore Cosign-signed pattern packs, and independent third-party penetration testing. All technical requirements for SOC 2, HIPAA, and PCI DSS compliance.
Common questions about G8KEPR security and trust
We're transparent about our security practices and compliance status.
Contact our security team for detailed discussions about your requirements.
Run on your own infrastructure • Full data control • Enterprise security