Security & Trust Center

GSCORA API Platform is designed for Japanese enterprise security review. The control plane runs in a Japan region, with encryption in transit and at rest, access control, and audit logs.

Your requests are authenticated, policy-checked, and routed by the GSCORA control plane (Japan region), then sent to the selected model provider. Inference regions differ by model. Control-plane metadata (usage, cost, audit) is processed in the Japan region.

Traffic is encrypted with TLS 1.2+ and data is encrypted at rest. Credential handling differs by type: GSCORA-issued tokens are stored only as non-reversible verifiers (hashes), never in plaintext. BYOK provider credentials are encrypted at rest with KMS envelope encryption and decrypted only on authorized requests.

Role-based access control (RBAC) manages permissions by department, project, and customer. SSO is planned.

Actions such as API key creation, policy changes, and budget changes are recorded in audit logs. The default retention period is 30 days, configurable from 90 to 365 days per contract. Audit logs contain metadata only — never prompts or generated content.

We are formalizing our security incident response process — reporting contact, triage, and notification — and validating it during Private Beta.

We are designing failover to alternate models when a primary model is unavailable, and are putting backup and recovery procedures in place.

The model providers we use as subprocessors for AI inference are listed in the AI Data Policy.

We offer a Data Processing Agreement (DPA) to Design Partners, available for review before contract.

Report vulnerabilities to security@gscora.com. See the Responsible Disclosure page for scope and response targets.

We do not currently hold SOC 2, ISO 27001, or similar certifications. SOC 2 control objectives are used as a design reference. Certification is on the roadmap.