Docs / Security and deployment

Privacy policy

A privacy policy is one JSON file, signed with your organization’s key. Verbiqo checks the signature before every request and refuses anything the policy does not allow. Nobody at the computer can edit it, and an older revision cannot replace a newer one.

Start

With the command line tool, on the computer that will keep your signing key (no licence needed):

verbiqo policy keygen policy-private.pem policy-public.pem
verbiqo policy template > policy.json

Keep policy-private.pem off the computers Verbiqo runs on; it is what makes a policy yours. Edit policy.json, then sign and check it:

verbiqo policy sign policy.json policy-private.pem policy-signed.json
verbiqo policy check policy-signed.json policy-public.pem

check verifies the signature and says, in plain words, what the policy allows. Signing refuses a policy with a mistake in it, and never overwrites an existing file.

A policy

{
  "schemaVersion": 4,
  "policyId": "example.verbiqo",
  "revision": 1,
  "inference": {
    "endpoint": "https://ai-gateway.example.internal/v1/chat/completions",
    "protocol": "openai-chat-completions",
    "routing": "remote-model",
    "allowedModels": ["qwen3-30b-instruct"]
  },
  "extensions": {
    "allowed": ["prom", "pg", "mysql"]
  },
  "features": {
    "allowed": ["rewrite", "explain", "ask", "summarize", "security-logs"]
  },
  "defaultAction": "allow",
  "rules": [
    {
      "id": "no-secrets-leave",
      "action": "block",
      "destinations": ["remote-model", "external-cloud"],
      "dataClasses": ["credential"]
    },
    {
      "id": "redact-personal-for-cloud",
      "action": "redact",
      "destinations": ["external-cloud"],
      "dataClasses": ["personal-data", "financial-data"]
    }
  ]
}

policyId and revision

A name for the policy, and a number you raise with every change. Verbiqo remembers the highest revision it has accepted on each computer and refuses an older one.

inference: the only AI service allowed

Any other endpoint, protocol or model is refused before anything is sent. routing is your assertion: Verbiqo cannot see where a gateway forwards a request, so keep cloud keys off a gateway you call remote-model.

extensions: which systems Verbiqo may read

Any of pg, mysql, mssql (SQL Server), redis (Redis and Valkey), es (Elasticsearch and OpenSearch), k8s (Kubernetes), prom, splunk, security (the security review of the connections allowed). An empty list allows none. The others disappear from Extensions and are refused if asked for. Use these short names exactly: verbiqo policy sign and check warn about a name this version does not know (kubernetes for k8s, say) and suggest the one meant, because a misspelt name silently allows nothing.

features: what people may use

Any of rewrite, explain (Explain, translate, draft a reply), ask (Ask and follow-up questions, including questions about systems), summarize (Summarize Document), security-logs (the hunts for security events and credentials in Splunk and the Elasticsearch log indices). An empty list allows none. A feature left out is refused with a message naming those allowed.

Upgrading: a policy signed before security-logs existed lists features without it, so the security hunts are refused on every computer until you add it, raise the revision and sign again. A policy with no features at all (schema 2 or 3) allows every feature.

limits: how hard Verbiqo may work your systems

Optional, from "schemaVersion": 5 (the template and the example above are schema 4, which has no limits; raise the number to add them): caps on queries and time per question, query timeouts, parallel queries and questions per hour, for every system or one. Nothing changes unless you set them. Protect your systems

"limits": {
  "all": { "queriesPerQuestion": 40, "questionsPerHour": 60 },
  "pg": { "queryTimeoutSeconds": 10 }
}

rules: what may be sent

Each rule blocks or redacts kinds of data going to kinds of destination. Redacted values are replaced before sending and restored in the answer.

Detection is by pattern: it finds these forms reliably and nothing else. Names, addresses or other personal details written out in prose are not detected.

Questions about your systems contain addresses. A rule that blocks network-identifier for your own AI service stops any answer that mentions an IP address or a URL, which most investigations do; redacting them hides what the model needs to explain. Apply it to external-cloud only, unless that is what you intend.

defaultAction is allow or block: what happens to a request no rule matched.

Deploy it

1. Copy the files

   Put policy-signed.json and policy-public.pem on every computer, where ordinary users cannot change them: for example /Library/Application Support/Verbiqo/ or C:\ProgramData\Verbiqo\, writable by administrators only.

2. Point Verbiqo at them

   With the same configuration profile or registry key as the managed settings:

Settings then shows the policy as managed.

Change a policy

Verbiqo only ever reads the signed file. Editing policy.json changes nothing until it is signed and copied out again.

1. Edit and raise the revision

   Make the change in policy.json and raise revision by one.

2. Sign it again

   Signing never overwrites a file, so remove the old signed copy first, then check that the result says what you meant:

   rm policy-signed.json
   verbiqo policy sign policy.json policy-private.pem policy-signed.json
   verbiqo policy check policy-signed.json policy-public.pem

3. Copy it to every computer

   Over the old file, readable by everyone and changeable by administrators only. On a Mac:

   sudo cp policy-signed.json "/Library/Application Support/Verbiqo/"
   sudo chmod 644 "/Library/Application Support/Verbiqo/policy-signed.json"

   No restart is needed: Verbiqo reads the policy on every request. A window already open, such as Ask, shows newly allowed systems when it is opened again.

4. Raise the minimum revision

   Once every computer has the new file, set the minimum revision to the new number. Until then, someone could put the previous file back; Verbiqo only refuses a revision lower than one it has already accepted on that computer.

Receipts

With a receipts path, every request appends one line of JSON: when, the policy and revision, the destination, the decision, which rules matched and how many items of each data class. Never the text, the answer, or the values found. Collect them with your existing endpoint agent or SIEM. If the file cannot be written, the request stops.

When something is wrong

• A policy that is missing, unreadable, unsigned, signed with another key, for another policy ID, or older than the minimum revision: every request to the AI service stops, and no system can be read. The message names the policy, so people know to contact you.
• A schema 2 or 3 policy keeps working: what it does not mention (systems, features) stays allowed.