Data Controls

Tenant isolation and access control

• Tenant binding: records and service paths are bound to an explicit tenant identity, and cross-tenant read paths are treated as defects and covered by regression tests.
• Role-scoped authorization: access is granted by role and least privilege rather than by shared credentials.
• Single sign-on: Enterprise entitlement supports OIDC and SAML identity providers with SCIM provisioning, so customer administrators control access from their own directory.
• API credentials: tenant API keys are stored as hashes, not as recoverable plaintext.

Encryption and key custody

• In transit: data moving between the browser, the API, workers, and integrated services is encrypted in transport.
• At rest for secrets: integration and identity secret material is sealed with authenticated envelope encryption through the configured key-custody backend, so a database or backup copy alone does not expose the plaintext secret.
• Key separation: encryption keys are held in the key-custody backend rather than alongside the ciphertext, and can be rotated.

Auditability and accountability

• Append-only audit trail: security-relevant administrative actions are written to an append-only, hash-chained audit log, so an after-the-fact edit is detectable.
• Finding history without hard deletion: findings move through a state machine (New, Confirmed, False Positive, WontFix, Fixed) rather than being hard-deleted, so the record of a decision is preserved.
• Erasure events: a completed tenant erasure writes its own auditable completion event.

Data minimization and redaction

• Credential redaction: newly stored agentic input, thinking output, and master-agent output have credentials redacted before they are written to disk.
• Metadata-only provider debugging: AI-provider debug output is limited to metadata rather than full prompt or response bodies where the mode is enabled. The CLI can still print a rendered prompt when an operator explicitly passes “--show-prompt”.
• Provider-bound prompts are not rewritten: redaction applies to stored artifacts. Content sent to an enabled external model provider is governed by that provider and its deployment settings, so secrets must not be placed in assessment inputs.
• HTTP debug logs omit query values, so tokens carried in a URL are not written to logs.
• No routine human review: customer assessment content is not routinely read by staff; access is limited to support the customer requests or to resolve a declared incident.

Erasure and retention controls

• Tenant erasure: a tenant erasure workflow deletes resolved tenant records, session directories under the configured sessions root, and configured object storage, and is blocked while an active legal hold applies.
• Backups: tenant erasure does not delete backup copies today. Backups are retained separately with rclone, and a retention and purge process is still required. Restoring a backup can reintroduce records; re-applying completed erasures through “governance erasure-reconcile” is a planned operator step, not yet automated.
• Immutable records: audit and accountability records are intentionally excluded from erasure during the agreement term and any legal hold, and the categories concerned are listed on the Data Retention and Deletion page.

Availability and environment separation

• Managed infrastructure with redundant components for the hosted service.
• Separate development and production environments, with production data not copied into development.
• Recovery mechanics are documented and exercised; exact recovery time and recovery point objectives are stated in the order package for a deployment rather than asserted here.

Agentic and AI-assisted processing

Agent-assisted triage runs inside the same tenant boundary as the assessment it belongs to. AI-assisted analysis is used only where it is enabled for the deployment, and run records, phase artifacts, and session directories are cleaned up on the schedule shown on the Data Retention and Deletion page. Where an external model provider is used, the provider and its retention behavior are named for that deployment before it is enabled. A configured AI gateway forwards model requests to its upstream providers; it does not itself redact prompt content, so provider and account retention settings remain part of the deployment review.

What this page is not

This page states controls we implement. It does not claim a certification, an attestation, or compliance with a named standard, and it does not replace the audit and information rights in the Data Processing Addendum. Where a control depends on a deployment choice — region, plan, or enabled integration — the authoritative statement is the order package for that deployment.