Every claim we make, verifiable.

Plain-English description of what we defend against, what we don't, and who the adversary is.

Clear scope, rules of engagement, and a single point of contact for security researchers.

Machine-readable security contact at /.well-known/security.txt.

Append-only record of every security-relevant incident, with post-mortems where appropriate.

Encryption flow, memory handling, TLS policy, employee access model, HSM key management, and audit logging - documented in full.

Government data request log, warrant canary updated quarterly, and our policy for responding to law-enforcement demands.

Pre-filled answers to standard procurement security questions with links to primary sources for verification.

GDPR/CCPA-aligned privacy policy and a Data Processing Agreement available for every customer.