Scope
Record the sanctioned purpose, customer, participants, channels, scenario boundaries and expected safe behavior.
Safety before realism
Deepfake simulation governance that survives scrutiny
Control who can authorize an exercise, whose voice may be used, what a scenario may request, which artifact was approved, what evidence is retained and how results are shared.
Governance model
Realism is valuable only when authority and boundaries are provable
Deepfake and social-engineering assessments can expose sensitive identities, communication patterns and individual behavior. Deceptiment therefore treats governance as part of the execution path rather than a policy document attached after launch.
The customer defines the authorized objective, audience, scenario and approvers. Voice-based work requires voice-owner consent evidence. Generated audio is reviewed before launch, and material changes to scripts, audio modes or source recordings invalidate stale approval. Test-delivery evidence is required for governed WhatsApp voice campaigns.
Safe scenarios measure behavior without requesting real transfers, credentials, authentication codes or genuine sensitive information. Results are intended for coaching and control improvement, not public exposure or punitive use.
Lifecycle controls01 02 03 04 05 06
Governance at every decision point
Consent
Document voice-owner consent and retain the evidence reference associated with the approved profile.
Safety review
Block scenarios that solicit secrets, funds, control bypass or other real-world harmful outcomes.
Artifact approval
Review the exact generated audio or campaign content. Changes invalidate prior review where relevant.
Controlled launch
Use readiness checks, test sends, schedules, bounded audiences and customer approvals before delivery.
Evidence and retention
Record events, approvals and outcomes; apply configured retention, archive and confirmed-deletion workflows.
Operational evidence
Make assessment activity observable
Deceptiment maintains a central operational event timeline covering authentication, governance, assessments, jobs, workers, webhooks, providers, integrations, retention and system actions. Events include source, severity, tenant, actor, outcome, target and correlation context where applicable.
Organizations can export normalized JSONL, CEF and CSV, configure worker-driven HTTP SIEM forwarding, or use a bearer-authenticated cursor-based SIEM pull endpoint. These controls help security teams bring assessment evidence into broader governance, monitoring and reporting workflows.
Frequently asked questions
Governance questions, answered directly
Who authorizes an assessment?
The customer’s designated stakeholders must formally sanction the exercise and its scope; platform access alone is not authorization.
Can participants withdraw?
The public responsible-use policy requires plain-language notice and supports withdrawal; voice use remains bound to documented consent status.
What happens after deletion?
The product documents retention enforcement, customer-confirmed deletion and pseudonymization of expired target data according to configured policy.
Does framework mapping equal certification?
No. Generated evidence may support controls and audits, but only the relevant auditor, regulator or qualified assessor can determine compliance.
Put governance in the demonstration—not only the contract
Ask to see consent, approval invalidation, safe interaction design, retention and evidence export live.
Book a governance-led demonstration →