GGOLD AI
Get access

Security & access

Designed for the day a credential is already stolen.

Security that works only while everybody behaves is not security. Everything on this page assumes the opposite, and every line of it is written as a guarantee rather than as reassurance.

Sign in and inspect itGet access
01Posture

Four stances that decide every argument.

When a security question is contested internally, one of these settles it. They are listed in the order we apply them, and they have never been applied in a different order to reach a convenient answer.

Posture

Least authority, always

Every person and every process holds the narrowest authority that lets it do its job, for the shortest time that is useful. Convenience has never once been accepted as a reason to widen it.

Posture

Nothing silent

A privileged action is recorded because of how the platform is built, not because a policy asks nicely. There is no setting in which one goes unwritten.

Posture

Assume compromise

Controls are designed for the day a credential is already in the wrong hands. One stolen secret is never permitted to be sufficient for anything consequential.

Posture

Honest about status

We do not claim a certification we have not been issued or a control we have not implemented. Where something is in progress, this page says in progress.

02Identity

Two ways in. Neither is the weaker one.

Member organisations never manage a second credential. Everybody else receives a full account held to the identical standard, with nothing withheld for arriving by the other door.

Route one

Ventureship single sign-on

Member organisations authenticate once at Ventureship and arrive already identified. One credential to manage, one place to revoke it, and no second password anywhere for an attacker to find.

Route two

Credentials of your own

A full account with verification, recovery that expires quickly and can be used once, and every other session ended the moment a password changes. Not a lesser tier for not being a member.

Both routes

One standard

How you arrive has no bearing on what you may do. Proving who you are and being permitted to act are separate questions, and neither answers the other by implication.

How you prove who you are and what you are then allowed to do are two different questions. Neither one answers the other by implication.

03Authority

Re-established as you act, never assumed for convenience.

A privilege withdrawn stops working on the next action, not at the end of a session. That costs us something every single time and we pay it deliberately.

01Session establishedConfirmed against a live identity rather than assumed from something the browser is holding.
02Authority resolvedRe-established for the action being taken, so a privilege withdrawn stops working on the very next one.
03Action attemptedMeasured against your limits before anything else about it is considered.
04Action recordedWritten with the actor, the target and the reason. The entry cannot be edited afterwards by anyone.
05Privilege withdrawnEffective immediately, with the withdrawal itself on the record alongside everything else.
04Your record

History grows. It is never quietly revised.

The trail is append-only as a matter of construction. No administrative interface edits it, because none was ever built — not for support, not for us, not for anybody who might one day ask.

  • Append-only

    Entries are added. A correction is a new entry that references the old one, never an overwrite of it.

  • Attributable

    Every action carries the person or the authority responsible for it, never a stand-in that explains nothing.

  • Complete

    Refusals are recorded alongside actions. A limit that held is every bit as interesting as one that did not.

  • Yours

    Exportable in full, at any hour, without a request to us and without a fee.

05Data

Collected narrowly. Used for exactly one thing.

Your record exists to serve your objective and to answer you. It has no second purpose, and we have already turned down the second purposes that were suggested to us.

  1. 01

    Collected narrowly

    Only what is needed to hold your position and answer you. Nothing is gathered speculatively against a future idea.

  2. 02

    Used for one purpose

    Your data serves your objective. It is not sold, not brokered, and not used to train anything on anybody else's behalf.

  3. 03

    Portable on demand

    Export the full record whenever you want it, without a request to us and without a fee.

  4. 04

    Deleted on request

    We keep only what the law obliges us to keep, and we will tell you precisely what that is in writing.

06Controls

What is guaranteed, stated without adjectives.

These are commitments about outcomes. How each one is achieved is not published — the same answer every party receives, which is the entire reason it is worth having.

In transit & at rest
Encryption

Recognised cryptography throughout, and no cleartext path for a credential anywhere.

Append-only
Audit integrity

Entries are added. No interface exists, for anybody, that rewrites history.

Every action
Authority checks

Re-established as you act rather than assumed from how you arrived.

Multi-region
Continuity posture

No single location is ever permitted to be the decisive one.

07Response

Contain first. Investigate second.

The instinct to understand before acting is how a small incident becomes a long one. Our first move is always to reduce authority, and we would rather look hasty than look relaxed.

  1. 01

    Detect

    Anomalies in access and authority surface on their own, rather than being discovered during a review.

  2. 02

    Contain

    The first move is always to reduce authority. Understanding can wait; exposure cannot.

  3. 03

    Tell you

    Affected clients hear from us with what we know — including while we still know very little.

  4. 04

    Account for it

    A written account of cause, change and timing, whether or not anybody turned out to be harmed.

08Continuity

Your limits hold even when we are having a bad day.

The stop is the least sophisticated part of the platform precisely so that it is the last thing capable of failing. If anything clever is unavailable, nothing moves and you are told.

Limits held during degradation

A limit is never relaxed because something upstream is unavailable. Degradation reduces capability, never protection.

Failures that are silent

A fault either reaches you or does not exist. There is no quiet-failure path, and that is a design choice rather than a happy accident.

09Disclosure

We will not claim a certificate we do not hold.

Security pages routinely imply certifications that are aspirational. This one does not. We build to the control expectations of the recognised frameworks, we will state our current status in writing, and we will not decorate this page with a badge we have not earned.

What we will put in writing

  • Current audit and certification status, exactly as it stands today
  • The control expectations we build to, framework by framework
  • Our incident history, and what changed after each one
  • Precisely what we hold about you, and what the law obliges us to keep

What we will never publish

  • Implementation detail of any control
  • Architecture, composition or the parts we depend on
  • Anything that narrows an attacker's search
  • Client identities, in any context, ever

Found something? Tell us today.

Security reports are acknowledged the same day and routed ahead of everything else in the queue. Good-faith reporters are credited if they want to be, and never pursued. Use the security subject on the contact page, or escalate from inside if you already have access.

Sign in to escalate
10Questions

The ones your security team will ask first.

Answered here so that the first call can be about substance rather than about getting a straight answer.

We build to the control expectations those frameworks describe: least authority, append-only audit, attribution of every change, encryption in transit and at rest, and documented incident response. We will not tell you we hold a certificate we have not been issued. Ask us directly for current status and you will get a straight answer in writing.

Access to client data is scoped, logged and limited to what an operational task genuinely requires, and any such access appears in your record. There is no unlogged administrative view, because we did not build one.

Change your password and every other session ends immediately. If your organisation signs in through Ventureship, revoking there removes access here at the same moment. Your limits stay in force throughout, which is the point of making them structural.

Yes, and an organisation can require it of everybody rather than leaving it to individual conscience. Where you arrive through Ventureship, your organisation's own requirements apply and are never weakened on our side.

No. Your record serves your objective. It is not sold, not brokered, and not used to train anything on anyone else's behalf — and there is no tier where that changes.

We will tell you what they guarantee, in exhaustive detail, and we will sit through your questions about it. We will not publish implementation detail. That is the same answer everybody gets, which is precisely what makes it worth something to you.

Due diligence

Send us your questionnaire. We answer it ourselves.

No portal, no consultant, no boilerplate handed back with your questions reworded. A person who understands the control answers the question about the control — and you can be inside looking at the platform while they do it.

Sign in to Gold AIGet access

Gold AI is operated by Ventureship. Obligations are published in full on this site; mechanism is published nowhere, to anybody.