Security Policy

1. Security commitments

SOC 2 Type II Aligned. ISO 27001:2022 Aligned. HIPAA available with BAA.

2. Encryption

TLS 1.3 in transit. AES-256 at rest. Per-tenant keys, sharded across regions.

3. Access controls

Per-agent identity (Ed25519). SSO/SAML/SCIM. MFA required for admin access.

4. Infrastructure

Multi-region. Daily backups. 7-year audit log retention.

5. SOC 2 / ISO 27001 status

SOC 2 Type II Aligned. ISO 27001:2022 Aligned. Latest reports available under NDA.

6. Penetration testing

Annual third-party pen test. Quarterly internal red-team exercises.

7. Bug bounty

Base $500, up to $25,000 for critical vulnerabilities. Email [email protected].

8. Incident response

24-hour notification for confirmed breaches affecting customer data. Status page updates in real time.

Last updated 2026-05-18. Templated v1; outside counsel review pending per ADR-005.

Questions: [email protected]