Pre-launch. Honest about what we have.

SOC 2

Planned. We have not engaged an auditor yet. We'll update this page (with auditor name + audit window) the day we sign the engagement.

ISO/IEC 27001

On the roadmap, after SOC 2.

HIPAA BAA

Roadmap. Available to Enterprise customers once SOC 2 Type II ships.

GDPR / UK-GDPR

DPA template + SCCs for EU data are available now. We sign customer-paper DPAs before any production data processing.

Penetration test

Not yet performed. Scheduled before first paying customer.

Tenant isolation

Every domain table carries a tenant_id column and is protected by Postgres Row-Level Security. Middleware sets app.tenant_id per request. There is no application path that queries another tenant's rows.

Encryption in transit

TLS 1.2+ (TLS 1.3 preferred). HSTS on every public hostname.

Encryption at rest

AES-256 via AWS KMS on managed datastores. Per-tenant CMK is on the Enterprise roadmap.

Authentication

WorkOS-backed SSO (OIDC + SAML). Cookie sessions are HttpOnly + SameSite=Lax + signed. No password storage. Identity Center / SAML enforcement of MFA at the IdP.

Audit-target credentials

The agent enters customer AWS accounts via STS:AssumeRole into a read-only role the customer provisions (CFT or Terraform module published in our repo). No long-lived customer AWS keys are ever stored.

Read-only enforcement (provable)

Every AWS API call from the agent passes through a botocore wire-level event hook that allows ONLY ops matching the regex ^(Get|List|Describe|Lookup|Search|BatchGet)[A-Z]. Mutations are rejected before the request leaves the process. The hook is enforced by the agent layer; tools cannot bypass it.

Audit trail (tamper-evident)

Every line of an audit's reasoning trail is hashed into a SHA-256 chain. The terminal hash is published on the audit-detail page and in the PDF / HTML / JSON report. A customer-facing verify endpoint (GET /v1/audits/{id}/audit-trail/verify) re-downloads the JSONL and recomputes — match means unmodified, mismatch means tampered. Audit-trail objects live in S3 with Object Lock in GOVERNANCE mode.

Reproducibility

Same AWS state, same audit goal, same scope produces bit-equivalent findings. Anchored by temperature=0 on every LLM call plus a content-addressable response cache. Severity disagreements between the two-pass ensemble demote to OPEN_QUESTION rather than picking a winner — variance is surfaced, never papered over.

Two-judge agreement

Every severity verdict runs through two independent reads on the same evidence. The finding is emitted only when both passes agree. Disagreement becomes an OPEN_QUESTION; we don't pick a winner. The per-pass record (model, severity, confidence, reasoning) is persisted on every finding in judge_votes and rendered as a “2 of 2 agreed” badge on the audit-detail evidence drawer — auditors can verify the agreement before accepting the verdict.

No model training on tenant data

Customer prompts and responses are contractually excluded from any model-training pipeline — ours, our infrastructure provider's, or a third party's. The exact subprocessor chain is disclosed on the subprocessors page; the contractual language is in our DPA.

Reversible PII tokenization (the LLM never sees raw PII)

Most AI compliance tools either (a) ship customer identifiers verbatim to a foreign LLM, or (b) one-way anonymize them so findings come back saying “user {EMAIL} has admin access” — unactionable, because you can't tell which user. We do neither. Every email, IP, and IAM ARN tail is replaced with a stable, opaque token like [CME-EMAIL-a1b2c3] before the prompt leaves our boundary. The mapping lives tenant-scoped in your Redis vault with a 24h TTL. When the agent emits a finding, we replace the token with the original value before it's saved — so the LLM only ever saw tokens, and your audit report cites the real identifier so your team can act on it.

Hard-block guardrail for credentials

Access keys, secret keys, bearer tokens, SSN, PAN, and PIN patterns are blocked at the AWS Bedrock guardrail layer — they never reach the model and are never tokenized either (storing them even temporarily would be the breach). Off-task prompts halt the audit cleanly with a customer-visible error. No partial / silent runs.

Prompt + response retention OFF by default

Inference traffic is processed in flight and discarded at request end. Nothing is retained server-side beyond the request lifetime unless the tenant explicitly opts in for corpus improvement (off by default).

No fine-tuning on tenant data

No per-tenant fine-tunes. There is no path for one tenant's data to influence another tenant's audit.