Security Architecture

Built for the Security
Teams That Will Review It

CISOs and Security Architects don't take governance products on faith. Here is exactly how Gatepost is deployed, what it can access, and what it cannot.

Principles

Six Security Principles

Each principle maps to a specific architectural decision you can verify during a technical review.

In-Tenant Deployment

Gatepost deploys exclusively as Azure resources within your subscription. The control plane, audit store, and policy engine all run in your environment. Gatepost has no infrastructure that your data ever reaches.

Zero Trust Architecture

Every internal service-to-service call is authenticated via managed identity. There are no shared credentials, no API keys stored in application config, and no permanent privileged access required during steady-state operation.

Entra ID Native Integration

Agent identity enforcement is implemented entirely through Entra ID service principals and managed identities — the same identity plane your security team already monitors, rotates, and audits.

Audit Log Integrity

Append-only audit records enforced at the database level — no update or delete operations are permitted on audit data once written.

Data Residency

Because Gatepost is deployed in your tenant, data residency is determined by your Azure region selection — not Gatepost's. EU customers deploy in EU regions. Data sovereignty requirements are met by design.

Blast Radius Containment

Each component operates with a least-privilege managed identity scoped to its specific function. No component has broader access than its role requires, and no customer data transits outside the client's Azure tenant at any point.

Identity Integration

Entra ID Native.
No Shadow Identity.

Gatepost does not maintain a separate identity store. Every identity assertion runs through your Entra ID tenant. Your security team retains full visibility and control.

  • Service principals registered in your Entra ID tenant — not Gatepost's
  • Conditional Access policies applied to Gatepost service accounts
  • Compatible with PIM-eligible role assignments for Gatepost administrative access
  • Audit of all Gatepost service account sign-ins via Entra audit logs
  • Compatible with Entra Workload Identity Federation

Identity Enforcement Flow

YOUR AZURE TENANT + ENTRA ID

AI Agent

then

Service principal presents identity

Gatepost

then

Gateway validates request context

Entra ID

then

Token validation and tenant identity

Policy Decision

then

Allow, deny, and log decision

M365 Content

then

Permitted SharePoint and Teams retrieval

Log Analytics

Audit trail written to your workspace

Zero data egress outside tenant boundary

Audit Trail

Your logs. Your workspace.
Your evidence.

Workspace

Your Log Analytics workspace — you own the data

Retention

Configurable — default 90 days, extendable to 7 years

Schema

Open KQL-queryable schema — no proprietary lock-in

SIEM

Native Log Analytics integration — audit events write directly to your workspace via managed identity, queryable in Microsoft Sentinel automatically.

Export

On-demand CSV and PDF export for compliance reporting and regulatory submission.

Integrity

Append-only audit records enforced at the database level — no update or delete operations are permitted on audit data once written.

Request a Technical Architecture Review

We provide detailed architecture documentation, infrastructure-as-code review, and direct access to our security team for enterprise evaluations.

Request Demo