Trust

Security by design.

Control first, in layers: read-only access, isolated tenants, an audit trail you can verify, and releases you can prove came from us.

Report a vulnerability →Verify a release
Read-only by defaultRow-level tenant isolationSigstore-signed

Defence in layers

Six layers between your network and risk.

Access

Read-only by default

Monitoring-only device credentials. Configuration write actions are blocked in the platform itself, and your engineer runs every recommended command.

Data

Tenant isolation

Each customer is a separate tenant, isolated in the application and enforced in the database with row-level security.

Record

Tamper-evident audit log

Every decision is written to a hash-chained audit log, so any change to history is detectable.

Identity

Multi-factor sign-in

TOTP multi-factor authentication per user. Passwords are bcrypt-hashed and session tokens are cryptographically signed.

Supply chain

Signed releases with provenance

Every release is signed with Sigstore keyless signing, with SLSA build provenance and an entry in the public Rekor transparency log.

Network

On-site collector

An edge collector runs inside your network and connects outbound, so device management interfaces stay private.

Release provenance

Prove every release came from us.

AssureMesh signs the SHA-256 checksums file of every release using Sigstore keyless signing via GitHub OIDC. Each signature is bound to a specific GitHub Actions workflow run on a specific git tag and recorded in the Rekor public transparency log.

Keyless means nothing to rotate, compromise or store. The anchor is the public Sigstore root of trust, operated by the Linux Foundation, plus the public Rekor log: both independently verifiable. Cosign verification is the supported method and replaces the earlier GPG workflow.

Signing tool
Sigstore Cosign: install instructions
Certificate identity
https://github.com/assuremesh/assuremesh/.github/workflows/release.yml@refs/tags/v<version>
OIDC issuer
https://token.actions.githubusercontent.com
Transparency log
search.sigstore.dev
Public good
Run by the Linux Foundation Sigstore project, with a public root of trust
verify a release
# Install Cosign once (macOS):
brew install cosign
# Or on Linux:
curl -L https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
  -o /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign

# Download the release artifact, the checksums file, and the cosign
# signature + certificate from the GitHub release page:
curl -LO https://github.com/assuremesh/assuremesh/releases/download/v0.1.0/assuremesh-v0.1.0-linux-amd64.tar.gz
curl -LO https://github.com/assuremesh/assuremesh/releases/download/v0.1.0/assuremesh-v0.1.0-checksums.txt
curl -LO https://github.com/assuremesh/assuremesh/releases/download/v0.1.0/assuremesh-v0.1.0-checksums.txt.sig
curl -LO https://github.com/assuremesh/assuremesh/releases/download/v0.1.0/assuremesh-v0.1.0-checksums.txt.pem

# Verify the signature was issued to the expected workflow at the
# expected tag. Mismatch on either field means do not trust the artifact.
cosign verify-blob \
  --certificate "assuremesh-v0.1.0-checksums.txt.pem" \
  --signature   "assuremesh-v0.1.0-checksums.txt.sig" \
  --certificate-identity     "https://github.com/assuremesh/assuremesh/.github/workflows/release.yml@refs/tags/v0.1.0" \
  --certificate-oidc-issuer  "https://token.actions.githubusercontent.com" \
  "assuremesh-v0.1.0-checksums.txt"

# Then verify the SHA-256 sums against the file you downloaded:
sha256sum -c assuremesh-v0.1.0-checksums.txt

Responsible disclosure

Found something? Tell us first.

Send a description to our security team. We work with good-faith researchers and respond on a clear timeline.

3AcknowledgementWithin 3 business days of receipt.
10Initial triage decisionWithin 10 business days.
✓Safe harbourNo legal action against good-faith researchers who avoid privacy violations and service disruption, report privately, and give AssureMesh reasonable time to remediate before public disclosure.
★RecognitionOptional public acknowledgement of your contribution, on request.
security@assuremesh.com →

Out of scope

  • Social engineering of AssureMesh personnel or customers.
  • Physical attacks on AssureMesh property.
  • Denial-of-service testing.
  • Findings limited to missing best-practice headers without demonstrated exploitation.

The machine-readable disclosure file is published at /.well-known/security.txt per RFC 9116.

Data and infrastructure

Where your data lives.

Hosting

Google Cloud

Production infrastructure runs on Google Cloud Platform (GCP) in us-central1. An on-prem or hybrid deployment can be scoped.

Sub-processors

Disclosed up front

Hostinger delivers email and Google Analytics processes public-site usage data. Optional or customer-specific processors are disclosed during contracting, before they receive customer data.

Programme

Documented programme

This page is the public summary of the AssureMesh information security programme, which is documented. Additional architecture, control and deployment detail is shared with prospective customers during security review.

Privacy · Website terms · Technology · Company · Last reviewed: 2026-10-05.