Security review & procurement

The answers your reviewer will ask for, before they ask.

Most of a security review is finding out what a vendor will not put in writing. Here is our position, including the parts that are not finished.

DPA, EULA & NDA	Shipped. All three are presented at activation and must be accepted before the product runs. Acceptance is recorded as a SHA-256 of the exact text shown, and a document whose hash does not match is rejected — so what you agreed to is provable later.
SOC 2	Readiness assessed, audit not started — this is our own control-by-control review, not a third-party opinion. As of 2026-09-07: 0 outright gaps, 12 of 15 tracked criteria implemented, 3 partial. None of the three close with more writing: change authorization (a two-person team cannot show segregation of duties — the gate produces a signed receipt of who ran it, not an independent approver), vendor-review cadence (the program and calendar are real, but the next checkpoint, 2026-11-01, has to actually happen before we can call the cadence demonstrated), and capacity/scaling (the storm-breaker concurrency bug is fixed and load-tested for real, but Helm autoscaling still can't be verified without a live Kubernetes cluster). We would That table is what we have today; the certificate isn’t.
Evidence generation	SOC 2 and ISO 27001 collectors ship in the product and assemble control evidence from real activity on your fleet.
NIST AI RMF	Mapped, not certified — there is no certifying body for a voluntary framework. Detection that runs on your machine and never stores raw content is Govern by architecture, not policy; the behavioral fingerprint and discovery scan are Map; anomaly scoring and the CVR score are Measure; the debate panel, containment, and hash-chained audit trail are Manage.
Post-quantum (PQC)	We don’t downgrade your post-quantum TLS. There is no PQC certification to hold — CNSA 2.0 and Executive Order 14409 bind federal and national-security buyers, not commercial software. What matters here: any tool that inspects TLS re-terminates it, and an older stack quietly drops the connection back to classical encryption. Both legs of ours negotiate hybrid X25519MLKEM768, with a test that fails our build if that ever changes. Our own signing is still classical (Ed25519, RSA-2048), so we are not CNSA 2.0 compliant and don’t claim to be.
Connection integrity	We verify the provider’s certificate, not just ours. An inspection tool re-opens your agent’s connection, so it decides what to trust upstream. The common library default skips that check entirely — anything that answers gets trusted. We found that default in our own build and fixed it: full verification, plus `AARIASEC_UPSTREAM_CA_BUNDLE` for self-hosted models behind a private CA. A test that relays a spoofed upstream fails our build.
Data residency	Your infrastructure only. No account, no cloud plane, no telemetry of content. One channel is on by default: anonymous hash-only detection signatures. One environment variable turns it off, and the app reports its own egress posture on the dashboard, so the egress posture is visible at a glance.
Data retention	30 days by default, and you control it. Raw event telemetry is pruned automatically on a configurable window (`AARIASEC_EVENTS_RETENTION_DAYS`); alerts, verdicts, fingerprints, and the hash-chained audit log are never touched by that job — the record that proves what happened outlives the raw data that produced it.
Subprocessors	None. There is no cloud plane for a subprocessor to sit behind — detection runs on infrastructure you control, so there is nothing to list. That holds for the cloud deployment too: running it in your own AWS account makes AWS your provider under your existing agreement, not a subprocessor we introduce between you and your data.
Air-gapped deployment	Supported. Air-gap mode switches off every outbound feature the product has — external threat-intel polling, TAXII export, licence-revocation checks. Nothing in AariaSec calls out.
Identity	SAML / OIDC with MFA, SCIM provisioning, custom roles, API keys.
Deletion & exit	Uninstall reverses the proxy setting and removes the certificate. A purge deletes detection data and issues a deletion receipt. The hash-chained audit log deliberately survives, so the record stays verifiable after a purge.
Support SLA	None defined. An uptime commitment describes a service we host; this runs on your own infrastructure, so there is no uptime for us to promise.
What the rules cover	226 of 289 compiled rules live against today’s telemetry, across nine named attack classes: prompt injection and content manipulation · credential theft and micro-exfiltration · agent hijacking, goal drift and alignment faking · privilege escalation and scope-lock violation · destructive tool chains · reconnaissance and enumeration loops · persistence, proxy bypass and egress evasion · MCP and tool supply-chain scope · multi-agent coordination and covert channels. Every class maps to rule files in the product, and every rule maps to EU AI Act articles, OWASP and NIST controls for the evidence pack.
Known limits	Published, not buried. Our detection benchmark shows the attack class we handle worst, and our platform notes list the bypasses a host-emplaced sensor cannot prevent. See the research →

See the full 15-criterion SOC 2 breakdown behind the summary count above

Trust Services Criteria, as of 2026-09-07. This is the same table our own readiness tracking uses. ✓ implemented, ◖ partial (with the specific remaining gap), no row is an outright ✗.

CC6.1 Logical access / authentication: ✓ implemented
CC6.2 Registration / provisioning: ✓ implemented
CC6.3 De-provisioning (leaver): ✓ implemented
CC6.6 Encryption at rest + key mgmt: ✓ implemented
CC6.7 Encryption in transit: ✓ implemented
CC6.8 Malicious software / integrity: ✓ implemented
CC7.1 Detect config changes / vulns: ✓ implemented
CC7.2 Anomaly monitoring: ✓ implemented
CC7.3 Evaluate security events: ✓ implemented
CC7.4 Incident response: ✓ implemented — technical controls plus a written incident-response plan (roles, severity tiers, lifecycle, playbooks grounded in our own named threats); no tabletop exercise run yet
CC8.1 Change authorization / testing: ◖ partial — segregation of duties is not achievable at two people; every other part of this control is evidenced
CC9.1 Risk mitigation: ✓ implemented — formal risk assessment with a scored register (9 named risks, likelihood x impact, cited evidence per row); first assessment on record, annual cadence not yet demonstrated over multiple cycles
CC9.2 Vendor / 3rd-party risk: ◖ partial — program is documented with a dated review calendar (next T1 checkpoint 2026-11-01); the cadence still needs to be demonstrated over a real window, which no amount of writing can shortcut
A1.1 Capacity / scaling: ◖ partial — real load-test evidence now exists (9,273 rows/sec sustained ingest; a genuine multi-worker race in the alert storm-breaker was found under real concurrency load and fixed); Kubernetes autoscaling itself still can't be verified without a real cluster, which we don't have to test against yet
A1.2 Backup / recovery: ✓ implemented

We are not third-party audited. This is our own control-by-control self-assessment. Ask for anything you want to independently verify — we'll tell you exactly what evidence exists for it.

Reviewing us and need something not listed? Ask directly — a real answer, including “we do not have that yet”.

Recently shipped. Real, dated fixes, most of them found by our own adversarial testing:

2026-09-16 — Provider-certificate verification shipped. Our own review found the proxy trusted any upstream certificate; a test that relays a spoofed response now fails the build. Shipped with a post-quantum no-downgrade gate covering both legs of the interception.
2026-09-08 — Storm-breaker concurrency bug found and fixed under real 5- and 10-process load: 3 of 10 concurrent alerts were being silently lost under lock contention. Verified 0 lost updates across repeated runs after the fix.
2026-09-07 — Automated baseline-poisoning risk scoring shipped: a completed baseline that also produced real detections during its own learning window is now flagged before its trust stamp issues, instead of silently trusted.
2026-09-07 — Secrets scanning (gitleaks) wired directly into the release gate itself, not just an optional manual step — it now runs on every gated push.
2026-09-07 — Incident response plan, a 9-risk scored risk register, and 7 written policies (InfoSec, access control, change management, business continuity, data retention, acceptable use, SDLC) published.

Currently raising to expand the team and fund an independent SOC 2 audit — capital and headcount are what actually move the remaining partial criteria, not more documentation.

Is this the right tool for you right now? If your process requires content-level forensic logs, third-party certification today, or vendor continuity guarantees beyond a two-person company, it is not yet. If you want behavioral detection that never holds the prompts, and you're willing to evaluate us as an early design partner, the free download and the open benchmark are the real starting points.

Back to the overview, or see how this compares to tools you already run.