Evidence,
not promises.
Everything your security team needs to verify Wakora before trusting it with a production fleet: the security model, the data-flow, the threat model, a signed SBOM, and the exact commands to rebuild the agent and match our hash. Every file below is covered by a signed checksum list. Download, verify, review.
The documents
01 · Security model
Transport with a pinned key, per-host rotating identity, machine-bound encryption at rest, signed everything, least privilege. The claims and how to check them.
Download PDF →02 · Data flow
Every data class: what leaves a host, what never does, transport, storage, retention, and who can see it. Secret values never leave the machine.
Download PDF →03 · Threat model
Assets, threats, the control for each, the residual risks we accept, and an honest list of what the agent can and cannot do.
Download PDF →04 · SBOM
The CycloneDX inventory generated by the build for this exact release, with the commands to verify its signature. The JSON ships alongside.
Download PDF →05 · Reproducible builds
The pinned toolchain, the published build inputs, and the exact command to rebuild the agent and match the signed hash byte for byte.
Download PDF →06 · Security reviews
Our review history with real findings and the release that fixed each one. Verifiable against the public source history.
Download PDF →07 · Incident response
How to report a vulnerability (with PGP), the response times we commit to, safe harbor for researchers, and how we disclose our own incidents.
Download PDF →08 · Subprocessors and DPA
The short vendor register with locations, and our standard-form Article 28 data processing agreement. Execution copies on request.
Download PDF →09 · Compliance statement
GDPR, EU residency, and the SOC 2 and ISO 27001 posture stated precisely, with no invented dates and no implied certificates.
Download PDF →10 · Access and change management
How code reaches production, how staff access is controlled and reviewed, and how a small team keeps separation of duties honest.
Download PDF →00 · Cover and summary
The one-page summary of every claim in the pack and where each one is proven. Start here if you route this to a reviewer.
Download PDF →Verify before you read
The pack is signed with the same ed25519 publisher key that signs agent releases and monitoring definitions. SHA256SUMS covers every file here; SHA256SUMS.sig is its signature; the key is published as wakora-publisher.pem and is compiled into every agent binary, so the source repository carries it too.
openssl base64 -d -A -in SHA256SUMS.sig -out sig.bin
openssl pkeyutl -verify -pubin -inkey wakora-publisher.pem -rawin -in SHA256SUMS -sigfile sig.bin
sha256sum -c SHA256SUMS --ignore-missing
Machine-readable extras: the CycloneDX SBOM for
the current release, the pack manifest, and
our PGP key for encrypted vulnerability reports
(fingerprint 258A 03A8 EEB9 8643 C23A A500 ECF8 DAA5 4406 4D43, also referenced
from security.txt).
Route this to your security team.
Then send them the agent's source. That order works best.