Trust center

Security you can verify

A product that authorizes what AI agents may do has to be trustworthy itself. This page lists the controls in place today, how we handle data, and what is not done yet, stated plainly.

Where we are

Stage

Early access

Built and tested controls, run by a small team.

Certifications

None yet

No SOC 2 or ISO 27001 report today. We will not show badges before they exist.

Penetration test

Not yet

An independent test is planned before general availability.

Service availability is published on the status page.

Controls in place

Each control below exists in the product today and is covered by automated tests.

Tenant isolation

The organization comes from your signed session, never from the request body, and every query is scoped by it.

Cross-tenant tests for events, reviews, keys, agents and members
PostgreSQL Row Level Security policies on tenant tables as a second layer

Accounts and sessions

Passwords hashed with bcrypt; login is rate limited and multi-factor authentication (TOTP with recovery codes) is available.

httpOnly cookies, 15-minute access tokens
Rotating refresh tokens with reuse detection
CSRF header plus SameSite cookies

Roles and approvals

Role-based access re-read from the database on every request, so role changes and removals apply at once.

Reviews need an owner or admin; optional separate approver
Single-use invitation links that expire after 7 days

API keys and secrets

API keys are shown once and stored only as a SHA-256 hash; they can be revoked instantly.

IP allowlists and keys bound to one agent
MFA seeds, webhook and vault secrets encrypted with AES-256-GCM, with key rotation

Audit integrity

The audit log is append-only at the database level and each entry is chained to the previous one by hash.

Chain verification available in the product
Every approval and denial recorded with the reviewer

Outbound calls

Webhooks, alerts and the gateway go through a shared guard: HTTPS only, private network ranges refused, no redirects, time and size limits.

Webhooks signed with HMAC-SHA256 and a timestamp
The decision path fails closed by default

How we handle your data

What we store

Action metadata: agent, action, resource, destination, record counts, decision and reasons.
Account data for the people who use the dashboard.
Credentials you place in the vault, encrypted and never shown again after you save them.

What we do not store

The contents of your records. Optional content samples are scanned in memory and only the kinds of data found are kept.
Passwords, tokens or API keys in plain text, in the database or in logs.

Privacy and legal

LGPD and GDPR

We act as a processor for the metadata you send. The privacy policy explains the legal bases and your rights. Privacy policy

DPA and subprocessors

A data processing agreement and the current subprocessor list are available on request. Ask us

Evidence for your audits

Customers can export compliance evidence and audit logs from the product for their own assessments.

Incident response

01
Detect
Alerts, logs and reports from customers and researchers.
02
Contain
Revoke keys and sessions, disable the affected path.
03
Notify
Tell affected customers without undue delay, as the law requires.
04
Learn
Fix the root cause and record what changed.

Report a vulnerability

Email security@vulnify.example with details and steps to reproduce. We acknowledge reports within 3 business days and ask for a reasonable disclosure window. Please do not access other customers' data, degrade the service or use social engineering.

Machine-readable contact: /.well-known/security.txt

Placeholder: the address uses the example domain until the production domain is set up.

Known gaps we are working on

No independent penetration test yet.
No SOC 2 or ISO 27001 certification yet.
A single database instance; encryption keys are not yet in a managed key service.
Row Level Security is a second layer; the application-level organization scoping remains the primary control.