Security and trust
A clear security model for telemetry, analysis, and human review
Artemes AI is an early access security platform. This page documents the controls and boundaries implemented in the current architecture without claiming certifications, guarantees, or deployment properties that have not been independently verified.
Application records separated by customer and authenticated private routes
Deterministic analytics and sourced vulnerability reference data before AI review
Draft analysis, quality checks, human review, and separate promotion
Current data flow
Separate raw telemetry, deterministic analytics, and workflow state
The platform uses different stores for different responsibilities rather than treating model output as the source of truth.
Telemetry and replay
Fleet/osquery results flow through Pub/Sub into BigQuery, where raw observations support scheduled deterministic analytics and replay.
Sourced reference data
CISA KEV and FIRST EPSS data are ingested into reference tables and joined through reviewed rules that link software to CVEs.
Customer workflow state
Firestore stores assets, findings, context reviews, assignments, schedules, and dashboard summaries within each customer context.
Application access
Keep private product data behind authenticated routes
Marketing pages are public; customer and administrative workflows use a separate authenticated application.
Explicit customer context
Private reads and writes carry a customer identifier, and application records use Firestore paths for that customer.
Authenticated mutations
Administrative requests and API requests that change workflow state require authenticated credentials and authorization checks on the server.
Separate public forms
Early access and newsletter submissions use dedicated endpoints and collections rather than application data paths.
AI control boundary
Treat model output as a draft that must earn promotion
The analysis workflow is designed to retain provenance and block unsupported claims from silently becoming canonical findings.
Bounded input
The analysis step receives an asset context bundle and sourced facts; missing exposure, threat, outcome, or compliance evidence should remain missing.
Quality checks
Deterministic checks flag unsupported claims, and blocking failures prevent controlled promotion.
Practitioner review
Review state and promotion state are separate so approval and canonical updates remain explicit operational decisions.
Transparency
What this page does not claim
Security buyers should be able to distinguish implemented controls from future commitments.
No certification claim
Artemes AI does not currently publish a SOC 2, ISO 27001, FedRAMP, or other certification claim.
No absolute guarantee
AI output can be incomplete or incorrect and remains subject to practitioner review.
Responsible disclosure
Report a suspected security issue to info@gsconsultingllc.com with enough detail for the team to reproduce and assess it. Do not include unnecessary sensitive data.
Have a security or responsible disclosure question?
Contact GS Consulting directly. Please avoid sending credentials, production telemetry, or other unnecessary sensitive information by email.
Email the security team