GRC

Security questionnaire

Print this page to PDF for procurement. Source: marketplace/SECURITY_QUESTIONNAIRE.md and docs/contract/CONTROLS.md.

What is Aegis?	Inline sidecar for LLM agents. Rust proxy on the tool path; Python control plane; optional Linux eBPF LSM.
Deployment	Customer VPC. Ubuntu 24.04 Aegis Node AMI/VM, or Docker Compose sidecar. Not multi-tenant SaaS.
Data plane	Customer traffic to the upstream LLM stays in the customer account. Live LLM bodies do not go through Python.
License	Offline Ed25519 AEGIS-1 key. Verified locally. No phone-home metering.
Admin auth	Cloud profile: AEGIS_AUTH_REQUIRED=1 plus OIDC or break-glass AEGIS_API_TOKEN.
Published ports	Command Deck :3000, LLM proxy :8080. Redis and gRPC stay on the compose network.
Secrets in the image	None. AMI/Packer does not bake .env, PEMs, or AEGIS-1.
SBOM	CI generates an SBOM (.github/workflows/ci.yml).
Not claimed	Not FedRAMP, FIPS 140, HA/multi-AZ. eBPF is Linux + Ubuntu image. Userspace still enforces without it.