Everything that follows — the architecture, the controls, the paperwork — is us honoring these three statements. If we ever break one, the entire relationship is on the table.
Every bit of operational data you send us remains your property — contractually, legally, and architecturally. On termination we return or destroy it, your choice, on your timeline.
US carrier data stays in US regions. Canadian carrier data stays in Canadian regions. No cross-border replication, no “eventual consistency” through a foreign zone, no telemetry sent off-continent.
Models trained on your operational data are trained for you, deployed to your tenant, and never re-used for another customer. Foundation-model calls go through a zero-retention contract.
How a request moves through our system — and where the fence between your network and ours actually sits. Single-tenant where it matters, isolated everywhere else.
The day-to-day mechanics — encryption, access, logging, supply chain. These are the line items a CISO expects to see, with the specific choices we've made.
Envelope encryption with per-tenant KMS keys you control. Bring-your-own-key supported; customer-controlled revocation cuts access in seconds, not hours.
No standalone accounts. SSO through your identity provider, provisioning through SCIM, MFA enforced via hardware keys or FIDO2. Service accounts are short-lived and scoped.
Every request carries its own authorization context. No ambient network trust. Attribute-based policies enforced at the data layer — not bolted on at the API.
Who did what, when, from where, against which record. Logs are append-only, timestamped, signed, and streamed to your SIEM in real time. We cannot redact them after the fact.
Credentials and signing keys live in an HSM-backed vault with short-leased access tokens. No engineer — including our founders — can read a production secret in clear text.
Reproducible builds. Signed artifacts with provenance. CVE scanning gates every release. A software bill of materials goes with every deployment — on request, to you, monthly.
Critical vulnerabilities patched within seven days of disclosure; high within thirty. Emergency hotfix path tested quarterly. Zero-day response documented and rehearsed.
Independent third-party penetration testing annually, and on any architecture-scale change. Findings, remediation, and a letter of attestation are shared with any customer on request.
Point-in-time recovery with immutable, offline-capable backups — including ransomware-resistant copies outside the primary blast radius. DR drills twice a year, scored.
A plain classification of operational data categories — where they live, who can access them, and (important) what we deliberately refuse to ingest at all.
If a data source we're asked to integrate carries categories we refuse, we design the integration to leave them behind at your perimeter. This is a design constraint, not a promise we make after the fact.
Everyone on our side of the fence is vetted, scoped, and time-boxed. Even with a ticket in hand, no engineer can casually open your data — and when they can, you see it.
Every PRIVATE/APP employee passes a criminal-records check and signs an operational-data confidentiality covenant on day one. Annual security-awareness training, tracked. Offboarding de-provisions access within four hours.
No engineer has persistent read access to your production data. Access is requested through a ticketed break-glass workflow, auto-expires in hours, and is streamed live to your SIEM before a single record is read.
The agreements that turn our promises into enforceable terms. If you need one we don't list, ask — most of these started as a customer-driven ask.
You are the controller. We are the processor. Purpose limitation, sub-processor register, deletion timelines — all named. Reviewed annually.
Standardized security addenda (CISA, NIST, AAR-aligned) available pre-executed. Carrier-specific addenda negotiated in days, not quarters.
Material-incident notice within 24 hours of confirmed impact; regulatory-grade disclosure package within 72 hours. Notification is a contractual obligation, not a courtesy.
You, or your designated third-party auditor, may audit our controls with reasonable notice. We maintain pre-packaged evidence for the common frameworks so audits take days, not weeks.
On termination: full export of your data in its native schemas, plus model weights trained on it, within 30 days. Destruction certificate within 60. No dark-copy retention — we write that in.
A published incident runbook — the five phases, with named timeframes. You find out before a journalist does. That is the entire design goal.
The questions every rail CISO asks in the first meeting — answered plainly, in the room.