Security & Data Practices
High-level overview of our engineering and operational approach. Sensitive infrastructure details are intentionally not published.
Last updated: [DATE] · Entity: [REGISTERED_ENTITY_NAME]
Access control and least-privilege practices
[Final copy for “Access control and least-privilege practices” to be drafted and reviewed by legal counsel.]
Authentication and account security
[Final copy for “Authentication and account security” to be drafted and reviewed by legal counsel.]
Environment separation
[Final copy for “Environment separation” to be drafted and reviewed by legal counsel.]
Secure development and code review
[Final copy for “Secure development and code review” to be drafted and reviewed by legal counsel.]
Backups and restore procedures
[Final copy for “Backups and restore procedures” to be drafted and reviewed by legal counsel.]
Monitoring, logging and alerting
[Final copy for “Monitoring, logging and alerting” to be drafted and reviewed by legal counsel.]
Dependency and patch management
[Final copy for “Dependency and patch management” to be drafted and reviewed by legal counsel.]
Cloud / VPS / CDN configuration
[Final copy for “Cloud / VPS / CDN configuration” to be drafted and reviewed by legal counsel.]
Data handling and vendor access
[Final copy for “Data handling and vendor access” to be drafted and reviewed by legal counsel.]
AI governance
- Human approval on money, legal and sensitive client-facing actions
- In-region or self-hosted options
- Full logs and audit trails
- Every AI vendor that processes client data is listed in our Privacy Policy
Incident response process
[Final copy for “Incident response process” to be drafted and reviewed by legal counsel.]
Responsible vulnerability disclosure
Report a vulnerability to [SECURITY_EMAIL].