Security

SOC 2 Type I available at design-partner signature. Type II by Q1 2027. ISO 27001 by Q2 2027. ISO 42001 (AI management systems) in the 12-month roadmap.

Tenant isolation enforced at the database layer (row-level security + per-tenant KMS keys). All secrets in HashiCorp Vault. Zero-trust network posture with SSO (SAML + OIDC), SCIM, RBAC/ABAC.

Data residency: US-East primary; Dublin for EU-tenanted customers; additional regions on request. Cryptographic audit trail with daily Merkle-root checkpoints into S3 Object Lock.

Penetration testing annually by NCC Group. Continuous scanning via Snyk + Semgrep + Wiz. Detection + response via a named MDR partner. Bug bounty program in planning.

Incident response: 72-hour customer notification; co-ordinated disclosure with affected customers; post-incident root-cause available on request.