Security
What is implemented, and what is not claimed.
Most security pages in this category are a wall of badges. This one is a description of mechanisms that exist in the codebase, followed by an explicit list of the things that are commonly implied and are not true here.
Access control
- Authentication is mandatory on every product route. The API surface is closed by default: a route is reachable only if it declares its authentication dependency, and the web layer denies any path not on an explicit public allowlist.
- Two credential types, separated by purpose. Session tokens for people using the interface; API keys for programmatic access. They are not interchangeable.
- Five roles (owner, admin, analyst, viewer and machine) with authorisation checked per product tier, not only per route.
- Tenant isolation. Every query that touches customer data is scoped to the tenant, and exposure calculations are computed per tenant rather than globally.
Evidence and audit
- Append-only audit log. Decisions and the inputs behind them are written once; entries are not edited in place.
- Hash-verifiable evidence chain. An exported decision carries an integrity hash that can be checked against the stored record, so a brief shown in a meeting can be tied back to what the engine actually computed.
- Provenance is not optional. Source, capture timestamp and method reference travel with a figure through exports and presentation views. There is no mode that strips them.
Personal data
- Personal data is never written to application logs. Where an identifier has to appear for correlation, it is reduced to a short irreversible digest. This is enforced by a test that fails the build, not by convention.
- Screening inputs are processed to answer the question asked and are retained under the customer's own configuration, not indefinitely by default.
- All timestamps are timezone-aware UTC, so an incident timeline reconstructs correctly across regions.
Data sourcing
- Every dataset behind a decision is a public official source or a source explicitly cleared for commercial use. They are listed by name with their licence.
- Licences that require attribution are attributed inside the product, not only on this site.
- No scraped datasets of unclear provenance, and no personal data purchased from brokers.
Engineering controls
- Secret scanning blocks the commit and the build. It is a gate, not a warning: a detected credential stops the pipeline.
- Outbound certificate pinning is available for the connections that fetch official source data.
- Changes run through an automated suite before merge, and the release notes record what was verified and what was not.
What is not claimed
Everything below is absent on purpose. If any of it becomes true, it will appear here with the evidence attached and a date.
- No SOC 2 report. No ISO 27001 certification. Neither has been started, and "ready" is not a certification.
- No independent penetration test or third-party security audit has been performed.
- No availability or uptime commitment, because nothing is measured against one yet.
- No bug bounty programme. Reports are still welcome: see below.
- The platform is not yet generally available, so none of the above is presented as an operating track record.
Reporting a vulnerability
Email solutions.satdata@gmail.com with enough detail to reproduce. You will get a human answer. Please do not test against third-party systems or attempt to access data that is not yours.