TRUST CENTER

Security, Privacy &
Compliance Transparency

Gaussian is a security product. We hold ourselves to the same standard we enforce on AI agents: full visibility, honest limitations, and verifiable claims.

SECURITY ARCHITECTURE PRACTICES

Active

Code Signing & Notarization

All Gaussian binaries are signed with an Apple Developer ID and notarized via Apple's notary service. System extensions require explicit user approval in System Settings → Privacy & Security.

Active

Local-First Architecture

All policy evaluation, process classification, and behavioral detection runs locally on-device. No telemetry, process data, or file contents leave the machine unless explicitly configured for SIEM export.

Active

No Kernel Extensions

Gaussian uses Apple's modern user-space APIs: Endpoint Security (ES), Network Extension (NE), and DNS Proxy Provider. No KEXT, no custom kernel module, no kernel-level attack surface.

Active

Enterprise MDM Deployment

Deployable via standard enterprise MDM (Jamf, Kandji, Mosyle, Microsoft Intune) as a signed PKG with configuration profiles. No manual install required.

COMPLIANCE & FRAMEWORK ALIGNMENT

SOC 2 Type II

In Progress

Audit engagement initiated. Expected completion Q1 2027.

GDPR / CCPA

Compliant by Design

Local-first architecture. No PII collection. No cross-border data transfer in default configuration.

ISO 27001

Roadmap

Planned after SOC 2 completion. Information security management system documentation in progress.

MITRE ATT&CK / ATLAS

Mapped

All 25 behavioral detection rules mapped to ATT&CK technique IDs. AI threat vectors aligned to ATLAS (AML.T0051, AML.T0054, AML.T0010).

DATA HANDLING & PRIVACY FAQ

What data does Gaussian collect?

Process metadata (PID, binary path, code signing identity), file access events, network flow metadata (destination IP/domain, port). No file contents, no keystrokes, no screen capture.

Where is data stored?

All telemetry is stored locally in JSONL format under /Users/Shared/macfirewall/. Enterprise configurations can optionally stream audit events to a configured SIEM endpoint (Splunk HEC, Datadog API).

Does data leave the machine?

Not by default. SIEM export is opt-in and configured via enterprise policy. When enabled, only structured audit events (verdict, rule ID, process metadata) are transmitted — never file contents or credential values.

Can Gaussian read my source code or credentials?

No. Gaussian intercepts OS-level metadata about file access events. It knows that a process attempted to open ~/.aws/credentials, but it does not read or transmit the file contents.

Need a Security Questionnaire or Vendor Assessment?

If your procurement team requires a completed security questionnaire (SIG, CAIQ, custom), vendor risk assessment, or architecture review document, contact us directly.

Request Security Documentation