Status, not claims.

Everything on this page is either implemented, in progress or absent, and it says which. A security page that only lists strengths is not useful to the person doing the assessment.

All systems operational99.98% over 90 days · updated 4 min ago
SERVICE HEALTH · LAST 90 DAYSoperationaldegradedno data
01SECURITY POSTURE
Encryption in transitIMPLEMENTED

TLS 1.3 only, HSTS preloaded, no legacy cipher suites.

Encryption at restIMPLEMENTED

AES-256 on all volumes; ledger segments separately keyed.

Key custodyIMPLEMENTED

Your KMS on Compliance and Sovereign; Provena KMS otherwise.

Access controlIMPLEMENTED

SSO with SAML, enforced 2FA, role separation for signing.

Audit loggingIMPLEMENTED

Every signing and admin action, append-only, exportable.

Penetration testingIMPLEMENTED

Annual third-party test; last report April 2026, two medium findings closed.

ISO 27001IN PROGRESS

Controls implemented and documented; certification audit Q1 2027.

SOC 2 Type IINOT YET

Not started. We will say so until it is.

Bug bountyIN PROGRESS

Private programme with 11 researchers; public programme planned.

02 · DATA RESIDENCY

Where every category of data sits.

Asset bytes are the sensitive part, and in Cloud they are processed in memory and discarded. What persists is the manifest, the hash and the ledger entry.

  • Asset bytesin memory only, discarded
  • Manifests & hashesDE · Nuremberg
  • LedgerDE + FI replica
  • Account & billingNL · Amsterdam
  • Verification (public tool)in your browser
SUB-PROCESSORS · ALL EU/EEA
  • HHetzner Online GmbHCompute and storage · DE
  • UUpCloud OyLedger replica · FI
  • MMollie B.V.Billing · NL

No US-based sub-processor is in the path of asset data. Changes are announced 30 days in advance.

SECURITY.mdDisclosure policy, PGP key, 90-day windowDPA & SCCsSignable PDF, no negotiation needed for standard terms
03INCIDENT HISTORY
  • DEGRADED18 Aug 2026 · 41 minEU trusted list refresh lagged; verdicts fell back to the last known good list and were marked PENDING.Post-mortem
  • DEGRADED2 Jul 2026 · 12 minVideo watermarking queue backed up behind a malformed container; signing was unaffected.Post-mortem
  • No security incidents to date. If that changes, it will appear here before it appears anywhere else.