Enterprise Architecture.
AI Under Control.
Rebel7.ai is built as an AI Governance and Risk Intelligence infrastructure with enterprise-grade standards, multi-tenant isolation, and traceable decision control.
Explainability
Every decision is traceable and justified
Human Oversight
No AI action executes without human approval
Auditability
Immutable, verifiable audit trail on every run
Infrastructure & Data Residency
- Managed PostgreSQL database infrastructure
- Row Level Security (RLS) active on all core tables
- Isolated serverless compute per tenant context
- Data residency in EU environment
- Encrypted communications via TLS
- Automated backups with restore capability
Each organization operates in a logically isolated perimeter at the database level.
Multi-Tenant Isolation & Access Control
- Row Level Security (RLS) on all core tables
- Tenant membership validation
- Role-Based Access Control: owner / admin / member
- Decision Authority Matrix for sensitive operations
- Service-role enforcement via verified backend token
All critical server-side endpoints verify: Authorization header, service token match, membership check, and org scope validation. No critical function is executable without server-side validation.
AI Governance – Approval-First Architecture
Core- AI generates a proposal — never a direct action
- Proposal saved for human review
- Human validation required before execution
- Controlled execution with immutable decision log
- Full alignment with EU AI Act requirements
Rebel7.ai eliminates AI write-autonomy. Every AI output goes through human oversight before any data is modified. This guarantees Explainability, Human Oversight, and Regulatory Alignment.
Decision Engine & TrustCore
- Decision Engine V2 in production
- TrustCoreEngine scoring every decision run
- Risk Weight Profiles per sector and organization
- Decision Authority Matrix enforcement
- Immutable audit trail per decision run
Every decision is versioned, org-scoped, linked to the authority matrix, and fully traceable historically.
Logging, Audit & Traceability
- Timestamped action logs for every operation
- Organization-scoped tracking
- Decision run tracking with full context
- SHA-256 cryptographic hash chain (LIVE)
- previous_hash linkage and chain_root verification
- Evidence package freezing and hash sealing
- Ed25519 cryptographic signing of evidence packages
- Hash mismatch and chain break detection
- Backend event monitoring
Tamper-evident evidence chain is in production. Every AI event is hashed, chained, and independently verifiable. Database-level WORM immutability is not claimed.
Subscription & Payment Security
- Subscription management via Stripe (PCI-DSS certified)
- Verified webhooks with signature validation
- Plan-code mapping enforced server-side
- No direct storage of card data
The full subscription lifecycle is validated server-side. Rebel7.ai never stores payment credentials.
Secure Development Practices
- Server-side input validation on all endpoints
- Server-side access enforcement
- No critical logic exposed client-side
- RLS policies applied to every sensitive table
- Membership check in all decision-critical functions
Security practices aligned with OWASP application security guidelines.
Incident Response & Control Framework
- Log analysis and event classification
- Scope isolation to contain impact
- Service-role containment procedures
- Data restore capability from verified backups
- Regulatory-compliant incident reporting
Internal framework evolving toward ISO-oriented standards.
Continuous Hardening Roadmap
- ✓ Multi-tenant RLS active
- ✓ AI approval-first operational
- ✓ Service token enforcement active
- ✓ Decision Engine V2 in production
- ✓ Hash-chain immutability active (SHA-256 + Ed25519)
- → Version freeze for decision weights
- → External penetration testing
- → ISO 27001 roadmap formalization
Security is not a state — it is a continuous process.
Security inquiries
security@rebel7.aiLast updated: March 2026