AI Assurance Hub← Home

Trust & Security

Security is core to a governance product. This page describes the controls we operate today and where we're headed.

Data protection

  • Encryption in transit — TLS everywhere, HSTS with preload.
  • Encryption at rest — sensitive fields (e.g. MFA secrets) encrypted with AES-256-GCM; passwords hashed with Argon2id.
  • Data minimization — you control what data enters the platform; sensitive/regulated data can be flagged and governed.

Tenant isolation

Every organization’s data lives in its own dedicated database schema. There are no cross-tenant foreign keys or shared tables for governed records — isolation is enforced at the schema boundary, and every request is bound to exactly one tenant.

Access control

  • Role-based access control with customizable, least-privilege roles.
  • SSO (SAML) and SCIM provisioning; optional enforced SSO and IP allowlisting.
  • Multi-factor authentication, required for privileged roles.
  • Time-limited, audited support access — never standing access to your data.

Monitoring & audit

  • Append-only audit trail of governance and account activity.
  • Audit-log export and SIEM streaming (pull API) for your security team.
  • Application error monitoring and a public status page.

Infrastructure & resilience

  • Hosted on DigitalOcean; runs across multiple instances for high availability.
  • Automated daily database backups with point-in-time recovery; documented DR procedures.
  • Secure software development: code review, automated tests, and CI security scanning (secret scanning, SAST, dependency audits).

Privacy

See our Privacy Policy, Data Processing Addendum, Subprocessors, and the legal center. Individuals can export or delete their account data in-app.

Compliance roadmap

SOC 2 Type II is in progress. We are not yet certified; the report will be available to customers under NDA once the audit is complete. Our controls are built around recognized frameworks — NIST AI RMF, ISO/IEC 42001, the EU AI Act, and OECD AI Principles — though the platform is a system of record and does not by itself certify legal or regulatory compliance.

Report a vulnerability

Found a security issue? Please email [email protected] with details. We appreciate responsible disclosure and will respond promptly.