Your context, in a bank you own.

Every assistant is building a memory of you. None of them is yours.

You explain yourself to one AI, then explain yourself again to the next. Each keeps its own private notes about you, in its own vault, on its own terms: you cannot read them side by side, cannot correct them in one place, and cannot take them with you. The more you use, the more scattered the picture of your world becomes, and the more often you start from scratch.

Gubbins is the other way round. One picture of your world, kept where you can see every fact and correct any of them. The assistants you use read and learn from it, under keys you grant and revoke, and every borrowing is written on a receipt. What they learn about you along the way they can only propose back: it waits in a review pile until you say yes. It is a bank, and you hold the ledger.

Honest about the present, too.

This is a vault. Here is what that actually means, and what it does not.

Gubbins holds no security certification. Nobody has audited this and no badge on this page would mean anything if it were here. What can be shown is the practice: what gets checked, what gets attacked before it ships, and what is written down when it goes wrong. All of it is in the codebase rather than in a brochure.

The build is measured against the OWASP Application Security Verification Standard, one row per control, with a state and the evidence for it. The record's own rule is the part worth reading: a row counts as met only when something in the repository proves it, and "we believe so" is written down as a failure. Today that list is 50 controls: 34 met, 9 partly met, 1 written but not yet applied, 4 not applicable, and 2 not met. The two that are not met are recorded as not met, with the reason, because a checklist that only ever goes up is one nobody is reading.

It moves downwards when the truth does. On 28 August a control was downgraded from met to partly met because a new layer made its old evidence false: the thing it claimed we could not do, we were about to be able to do. Changing the badge would have been easier than changing the code, and the record says so at that row.

The OWASP Top 10 and the OWASP Top 10 for LLM Applications are the threat catalogues, and prompt injection is tracked across four separate fronts, because text reaching an AI from a memory, from a tool catalogue, from a stored document and from a live tool response are four different problems with four different answers.

Every layer gets a threat model written before it is built, not after, and it earns its keep: designing the Google sign-in caught a deletion that would have erased existing accounts, and modelling the permission layer caught a bug that would have made the whole thing serve nothing at all. Both were found on paper, before a line of either shipped.

Every guarded layer also gets an adversarial battery, a written set of attempts to get something out that should not come out, and none of those layers ships until its battery has run. Writing them has already paid: the one aimed at the credential vault found eight faults by being written, before it was ever run, and all eight are written up with the ones that were our own fault named as such.

What that produces in the product you can use today: every read of your context is receipted to you, so you can see which AI took what and when. A key is stored as a hash and never as text, so a stolen copy of the database yields nothing that opens anything. Credentials are stripped out of anything Gubbins writes down, so a secret cannot arrive in a log or on a receipt by accident. Traffic is encrypted in transit and data is encrypted at rest.

And the limit on that receipt, in the same breath as the promise, because a half stated promise is worse than none. Gubbins holds no file bytes, so when an agent needs a document it is lent a short reach into one folder of your own store and reads it there. We are not present for that read. A receipt records that access was granted, not which files were read. Your store keeps its own access log and that is where the other half lives. A receipt that looked complete would be the most misleading thing here, so it is said on the page rather than in the terms alone.

Being built now, and said plainly because it is not here yet: a vault for the keys to your other tools, built to one rule, which is that nobody reads a value back out of it. Not an AI, not another member, not an administrator, not Gubbins, not you. A secret can be used on your behalf and never shown, so a lost one is rotated rather than recovered. That layer is written and tested and has not been deployed, and no credential of any kind, real or otherwise, has ever been put into it. Before any real one is, an independent human security review is budgeted work rather than optional polish, because a checklist passed by the people who wrote the code catches classes of fault and not the blind spots shared between the builder and the tester.

As for accreditation: Cyber Essentials is an intention and not a status. When something is achieved rather than intended, this page will say which and when.