Compliance
What we hold (no certifications), what we do instead, and the release gates every feature has to pass.
Compliance posture, item by item
No SOC 2 report is held, and no audit is under way.
Not certified. No certification body is engaged.
Data classification, consent and redaction are designed in (spec 12). The privacy policy is a draft pending legal review; a data-processing agreement is not yet available.
One region, one host. Per-tenant regions (India, EU, global) are designed but not built (ADR D-17).
No independent penetration-test report is available to share.
Report issues to the contact address with the subject "Security". A formal policy with response times and a safe-harbour statement is not yet published.
Not yet published as a formal list. The third-party services the code calls are listed on the privacy page.
Export your own data as JSON and request account deletion (7-day grace period) from the console; anything else by email.
What we run instead of a certificate
These are engineering controls with evidence in our repository and on the production host. They are not an audit, and we do not present them as one.
Every backend suite runs on Python 3.10 (the production version) and 3.11 against a real PostgreSQL 16, and a skipped security test fails the run.
Cross-tenant read and write tests, including row-level security against PostgreSQL, run in CI as a release gate.
A release-gates workflow runs pip-audit and npm audit and produces SBOMs; vulnerable dependencies were upgraded on 2 October 2026.
Seeded mutation fuzzing for every ingest parser was added on 2 October 2026.
Daily checksummed backups (14 days, at least 3 kept) and a weekly automated restore drill; the first drill passed. Operations documentation records encrypted off-site copies. Restore checks remain necessary; a backup is not proof of recovery.
No Windows or Apple code signing yet. Unsigned preview downloads exist; signed production releases remain blocked.
A capability is not done until every gate passes
- Security
- Threat model, privilege review, authentication, authorisation, input validation, no new privileged host capability
- Privacy
- Data classification, retention, redaction, consent where needed, deletion verified end to end
- Response
- Policy gate, audit record, recovery path, rollback path
- Testing
- Unit, integration, platform, security, negative and failure tests
- Distribution
- Signed, staged, rollbackable, monitored
- Revoked consent: telemetry refused, nothing new reaches the timeline
- Reused enrolment code refused; expired code refused
- Forged device token refused, with no distinguishing detail
- Spoofed device identity in a request body: the server-stamped identity wins
- Expired or downgrade update manifest refused
- Cross-tenant read attempt refused at the data layer
- Policy that fails to parse falls back to the safety gate, never open