Legal
Security
Last updated [TO CONFIRM]
Written for the security reviewer who has been handed our name and asked whether we can be let near a mainframe. Everything below reflects how the product is actually built.
01Deployment model
Refinery is designed to run inside your perimeter, on-premise or in your own cloud tenancy. There are no mandatory external service dependencies: the audit engine, the formal verification layer, the certificate generation and the governance portal all operate offline. Your COBOL does not need to leave your estate for Refinery to work.
02Evidence integrity
Every audit produces a Change Contract PDF with a SHA-256 fingerprint computed over the binary output, stored alongside the record. The document cannot be altered without invalidating that hash.
Signing is fail-closed: an audit record that cannot be signed is rejected rather than stored unsigned, so tamper-evidence cannot be quietly opted out of. CRO sign-off is write-once: once a change is signed off, subsequent write attempts to that record are refused.
03Access control and audit trail
Accounts support multi-factor authentication, and tokens can be revoked. Actions are written to a hash-chained activity log, so removing or editing an entry breaks the chain and is detectable. In multi-tenant deployments, estate data is tenant-scoped.
04What we are honest about
Two checks (compilation and dynamic output equivalence) require GnuCOBOL to be present. If it is not, those checks are disabled, the active check count drops from 11 to 9, and every generated certificate says so explicitly rather than presenting a degraded run as a full one. The same applies to the parser: if the tree-sitter grammar is unavailable the engine falls back to heuristics and records which mode ran, all the way through to the PDF.
Where the product models rather than measures something (for example, estimated CPU savings in synthetic-telemetry mode), the result is machine-readably tagged as a calibrated estimate, not a measurement.
05Reporting a vulnerability
If you believe you have found a security issue, email [TO CONFIRM: security contact email]. Please include enough detail to reproduce it. We will acknowledge within [TO CONFIRM: response window] and will not pursue legal action against researchers acting in good faith under this policy.
06Certifications
[TO CONFIRM: state your current position honestly, e.g. which certifications you hold, or that you hold none yet and what your roadmap is. Do not list a standard you have not been audited against; a security reviewer will ask for the report.]