Security
Governium is designed for production enforcement where decisions must be deterministic, attributable, and safe by default.
API keys
API keys are stored as SHA-256 hashes for lookup. The plaintext value is encrypted at rest and can be revealed once in the account UI. After reveal, the encrypted material is removed.
Safe failure modes
The gateway rejects invalid requests early and returns explicit error codes for missing keys, rate limits, monthly limits, and malformed inputs.
Deterministic, audit-friendly responses
Every decision includes a decision field (allow/block), a reason code, policy bundle identifiers, and a request ID. These fields support incident reviews and compliance evidence.
Data access control
Firestore rules prevent client-side writes and keep API key material server-only. Stripe provisioning updates subscription status and key state through server webhooks.