Trust & Security
Our commitment to data privacy, infrastructure security, and transparent AI operations.
🔐 Data Privacy
We have strict, zero-data-training policies in place. Your data belongs entirely to you. We never use your inputs, files, or conversations to train public AI models. Every tenant operates in an isolated, encrypted environment — your data never mixes with anyone else's.
- Zero-data-training guarantee — your data never trains public models
- Isolated tenant environments with strict data boundaries
- Encrypted at rest (AES-256) and in transit (TLS 1.3)
- Full data export and deletion on request
🛡️ Infrastructure Security
Our platform runs on cloud infrastructure using industry-leading security standards, including SOC 2 and ISO 27001-aligned controls. We employ network isolation, intrusion detection, and 24/7 monitoring to protect your AI operations.
- SOC 2 / ISO 27001-aligned security controls
- Network segmentation and least-privilege access
- Continuous vulnerability scanning and penetration testing
- 24/7 security monitoring and incident response
🔒 Encryption
All communications between your browser and our autonomous agents are fully encrypted using standard TLS protocols. Data remains protected in transit and at rest with industry-standard encryption. API calls, webhook payloads, and stored artifacts all follow the same encryption standards.
- TLS 1.3 for all data in transit
- AES-256 encryption for data at rest
- End-to-end encrypted API communications
- Secure key management with regular rotation
✅ Compliance & Audits
We maintain continuous compliance monitoring across major AI regulations. Independent third-party audits validate our security posture annually, and our platform generates audit-ready reports for your own compliance needs.
- EU AI Act compliance framework implementation
- US AI Executive Order alignment
- ISO/IEC 42001 AI management system support
- Annual third-party security audits
🏗️ Security Architecture
AuditTrue's infrastructure is designed with defense-in-depth principles. Each layer of the stack is independently secured and monitored:
- Edge layer: Cloudflare WAF with custom rule sets, DDoS protection, rate limiting, and bot mitigation. All traffic inspected for common web vulnerabilities (OWASP Top 10).
- Application layer: Input validation, output encoding, parameterized queries, and CSRF protection on all endpoints. Regular dependency scanning for known CVEs.
- API layer: OAuth 2.0 / OIDC authentication, API key rotation, per-endpoint rate limits, and request signing for sensitive operations.
- Compute layer: Containerized workloads with read-only root filesystems, non-root execution, and seccomp profiles. Workload isolation via namespace separation.
- Storage layer: Encrypted persistent volumes with key management via hardware security modules (HSMs). Database connections over TLS with certificate pinning.
- Network layer: Private subnets for all internal services. No direct internet exposure for databases or internal APIs. VPC peering restricted to authenticated endpoints.
🌍 Data Residency Options
We understand that data sovereignty matters. AuditTrue offers deployment options to meet regional data residency requirements:
- EU region: All data stored and processed within EU-based infrastructure, suitable for GDPR data localization requirements.
- US region: Default deployment for North American customers, with data confined to US-based data centers.
- Custom regions: For enterprise customers requiring specific jurisdictional boundaries, additional regions can be provisioned on request.
- Data transfer controls: Cross-region data movement is disabled by default. Any required transfers follow SCC and adequacy framework documentation.
👥 Access Control Model (RBAC)
AuditTrue implements role-based access control with fine-grained permissions:
- Roles: Pre-defined roles include Organization Admin, Compliance Manager, Risk Analyst, Auditor (read-only), Developer, and Viewer. Custom roles available for enterprise tiers.
- Permissions: Granular permissions per resource — model registries, risk assessments, audit trails, policy documents, and compliance reports. Each permission is independently assignable.
- Principle of least privilege: Default access is minimal. Administrators must explicitly grant additional permissions. No implicit access via group membership alone.
- Multi-factor authentication: Required for all admin and compliance manager roles. TOTP and hardware key support (WebAuthn / FIDO2).
- Session management: Configurable session timeouts, concurrent session limits, and forced re-authentication for sensitive operations.
- Audit logging: Every access decision, permission change, and authentication event is logged with user identity, timestamp, IP address, and action taken.
🚨 Incident Response Process
Our incident response process follows a structured playbook to ensure rapid detection, containment, and resolution:
- Detection: Automated alerts from SIEM, anomaly detection, and customer reports are triaged within 15 minutes during business hours and within 60 minutes off-hours.
- Classification: Incidents are classified by severity (S1 critical through S4 low) based on data exposure, service impact, and customer scope.
- Containment: S1 and S2 incidents trigger immediate isolation of affected systems, credential rotation, and traffic blocking at the edge.
- Investigation: Forensic analysis preserves evidence in tamper-evident storage. Root cause analysis is conducted and documented for every S1-S3 incident.
- Notification: Affected customers are notified within 72 hours of confirmed data exposure, per GDPR Article 34 and contractual SLAs. Notifications include incident scope, data types affected, mitigation steps, and remediation timeline.
- Post-incident review: Every incident triggers a blameless post-mortem published internally. Action items are tracked to completion with assigned owners and deadlines.
📢 Vulnerability Disclosure Policy
We welcome security research and responsible disclosure. If you believe you have identified a vulnerability in AuditTrue:
- Report channel: Email [email protected] with a detailed description, reproduction steps, and impact assessment.
- Response time: We acknowledge reports within 48 hours and provide initial assessment within 5 business days.
- Safe harbor: Good-faith security research conducted within our guidelines will not result in legal action.
- Credit: With your permission, we credit researchers in our security acknowledgments. CVEs are requested for confirmed vulnerabilities.
- Bounty: We operate a limited bug bounty program for critical findings. Contact us for scope and eligibility.
🔗 Sub-Processor List
AuditTrue uses the following sub-processors to deliver our service. All sub-processors are bound by data processing agreements and maintain appropriate security certifications:
- Cloudflare: CDN, WAF, DDoS protection, and edge DNS. SOC 2 Type II, ISO 27001 certified.
- Hostinger (Hostinger International): Primary cloud infrastructure and compute hosting. ISO 27001 certified.
- Transactional email provider: System notifications and alerts. Encrypted in transit and at rest.
- Analytics provider: Product usage analytics, privacy-preserving. No personal data shared without explicit consent.
Customers are notified at least 30 days before engaging any new sub-processor. Enterprise customers may object to sub-processor changes per their DPA terms.
🔄 Business Continuity & Disaster Recovery
AuditTrue maintains business continuity and disaster recovery plans to ensure service availability:
- Backup strategy: Automated daily backups of all customer data with 30-day retention. Weekly full snapshots stored in geographically separated regions.
- RTO / RPO: Recovery time objective of 4 hours and recovery point objective of 1 hour for production systems.
- High availability: Multi-zone deployment with automatic failover. Load balancing across at least two availability zones.
- Disaster recovery testing: Full DR drills conducted semi-annually with documented results and improvement actions.
- Data portability: Customers can export all their data at any time in standard formats (JSON, CSV). Full export available within 24 hours of request.
🔬 Penetration Testing
AuditTrue undergoes regular penetration testing to validate our security posture:
- Annual third-party penetration test: Conducted by an independent CREST-certified security firm. Covers application, API, infrastructure, and authentication systems.
- Internal red-team exercises: Quarterly red-team engagements simulate real-world attack scenarios including social engineering and supply chain vectors.
- Continuous vulnerability scanning: Automated scanning of all infrastructure and application components runs daily. Critical findings trigger immediate remediation workflows.
- Remediation SLAs: Critical vulnerabilities patched within 24 hours, high severity within 7 days, medium within 30 days. All fixes are verified before deployment.
- Customer access to reports: Summary penetration test reports are available to enterprise customers under NDA upon request.