Trust Center

ResponsibleAI's security, privacy, and compliance posture — stated as current fact, not aspiration. Where a control doesn't exist yet, that's said plainly here rather than implied or omitted.

Open source (MIT) SSO (OIDC) TOTP MFA Tamper-evident audit log SOC2 — not started Pentest — not started

🔐 Security posture at a glance

Authentication & Access

OIDC SSO with enforceable SSO-only mode, plus optional org-enforced TOTP MFA (RFC 6238) at dashboard login with single-use backup codes. 4-tier RBAC (Owner/Admin/Analyst/Viewer) on every endpoint. API keys stored as SHA-256 hashes only, never in plaintext.

● Implemented

Multi-tenant isolation

Every governance data table carries an org_id and every query filters by it. Cross-org leakage is treated as a security defect.

● Implemented

Audit trail integrity

Hash-chained audit log detects direct database tampering. Exportable for SIEM. Does not defend against a fully compromised database — stated honestly, not oversold.

● Implemented

Encryption at rest

Whole-database disk/volume encryption remains the deployer's responsibility — that hasn't changed. Additionally, four specific PII/secret columns (audit log IPs, incident reporter name & contact, webhook signing secrets) use opt-in application-layer field encryption via RAI_FIELD_ENCRYPTION_KEY, so they're unreadable even with raw table access but no app key.

● Partial — field-level opt-in, disk-level still infra-dependent

Dependency scanning

pip-audit runs on every CI build against the full resolved dependency tree. Findings are triaged and documented, not silently ignored.

● Implemented

Third-party penetration test

Not yet performed — cost-gated. An automated OWASP ZAP baseline scan is available as an interim measure and explicitly disclosed as such, not a substitute.

● Not started

📍 Data residency

Deployment modeWhere your data lives
Self-hosted (Docker / Helm / bare-metal)Entirely within your own infrastructure and region. Nothing leaves your network unless you explicitly configure an outbound integration.
Hosted MCP, self-operatedSame as above — a transport option you run yourself, not a managed service we operate.
ResponsibleAI-operated SaaSDoes not exist yet. No such tier is live. This page will be updated with specific regions and a sub-processor list before one is sold.

📜 Compliance documents

CAIQ Self-Assessment
CSA-aligned, 17-domain security questionnaire — self-administered, ~300 questions worth of coverage, answered honestly.
→
NIST CSF 2.0 Self-Assessment
Maturity rating across all six CSF functions — Govern, Identify, Protect, Detect, Respond, Recover.
→
Enterprise Security Posture
Encryption, residency, audit integrity, SSO, RBAC, multi-tenancy — the detailed version of this page.
→
Service Level Agreement
Uptime tiers, response time targets, disaster recovery RPO/RTO, incident classification.
→
Vulnerability Disclosure Policy
How to report a security issue — 48-hour acknowledgment, 7-day resolution target.
→
Privacy & Data Handling
Differential privacy guarantees for the federated learning module, data residency for that subsystem.
→
Data Processing Agreement (draft)
Sub-processor list (OCI, Stripe, your own IdP) and standard DPA structure — a starting draft for your legal team to redline, explicitly not yet attorney-reviewed.
→

💬 Said plainly

We are not SOC2 or ISO 27001 certified. That requires a licensed CPA firm audit and costs real money regardless of company size — we haven't started it, and we won't claim otherwise. In the meantime, the documents above are the actual, verifiable substitute: specific, cited, and updated when the code changes rather than left as static marketing copy. If a claim in any of them is stale relative to the code, the code is ground truth — tell us.