Skip to main content

​
Audit Trail

Every significant action in ChangeGuard AI is recorded in an immutable audit trail. The application backend can append new entries but does not have the privilege to modify or delete existing ones — audit history is append-only at the database grant level, not just by application convention. Even an elevated session inside the backend cannot rewrite history. Recorded actions include:
  • Pre-flight verdict decisions (SHIP, HOLD, BLOCK)
  • Approvals and policy authorizations of a change, with the approver or the policy id and version
  • Permit issuance, consumption, expiry and revocation (with its reason), and every execution attempt — correlated by Permit id and attempt id, never by recency
  • Policy evaluations and scoring events
  • CI/CD validation requests and results
  • Suppression changes (muted/unmuted risks)
  • Configuration changes (notification channels, policies)
  • ArgoCD sync events and webhook activity
Each audit entry includes:

​
Audit Export

Export the full audit trail as CSV or JSON from the Audit trail view (open it from the command palette, or from an environment’s page) with Export CSV / Export JSON, or from GET /api/audit/export. The CSV includes all fields above, plus GitHub/GitLab context (PR number, approval status, CI pass/fail, branch, commit SHA) when available. Source IP is included in every row for incident correlation.
Use audit exports for compliance reviews, incident investigations, and change management reporting. The export covers your full history — there is no time limit on retention.

​
Security Headers

The ChangeGuard AI dashboard enforces modern security headers on every response:

​
Error Handling

API error responses for server-side failures return a generic "Internal server error" message. Detailed error information is logged server-side only and never exposed to clients. This prevents information disclosure that could aid attackers. Validation errors (400-level) return specific, actionable messages to help users correct their input.

​
Security Monitoring

ChangeGuard AI logs security-relevant events for monitoring:
  • Login success: Email, tenant, source IP
  • Login failure: Email, source IP
  • Rate limiting: Email, source IP, endpoint
  • API key creation/revocation: Key prefix, scope, tenant
  • Integration config changes: Provider, tenant
  • Webhook blocks: URL, reason (SSRF prevention)
These logs are available via Kubernetes log aggregation on the backend deployment.

​
Certifications and controls

ChangeGuard AI does not currently hold SOC 2, ISO 27001, FedRAMP or any other formal certification, and does not claim one. What it does have is a set of implemented, continuously tested controls — described below and proven as described in Testing and assurance — organized here by the categories security reviewers usually ask about:
If your organization requires a formal attestation, a security questionnaire, or has specific compliance questions, contact security@changeguard.ai — you will get an exact answer about what exists today.

​
Responsible Disclosure

If you discover a security vulnerability in ChangeGuard AI, please report it to security@changeguard.ai. We commit to acknowledging reports within 24 hours and providing a remediation timeline within 72 hours.