Security

1. Security Overview

AIF Trust is built on a security-first architecture. Our platform enforces constitutional governance, sealed evidence packages, and zero-trust identity at every layer. This page describes our security practices, infrastructure, and how to report vulnerabilities.

We do not hold security certifications (SOC 2, ISO 27001, FedRAMP) at this time. Our early-access partners include organizations with these requirements, and we are building toward formal attestation. All claims on this page are verifiable through our architecture and evidence packages.

2. Infrastructure Security

2.1 Cloudflare Network

• Website and API hosted on Cloudflare Pages with Workers Functions.
• WAF (Web Application Firewall) with OWASP Top 10 ruleset enabled.
• DDoS protection (Layer 3/4/7) included automatically.
• TLS 1.3 enforced; HSTS, CSP, and security headers configured.
• Edge caching with cache-tag invalidation for instant purges.

2.2 Platform Runtime (Customer Environments)

• Temporal clusters deployed in customer-controlled cloud accounts (AWS/GCP/Azure) or on-premises.
• No multi-tenant control plane — each customer owns their namespace and data.
• mTLS between all Temporal services (frontend, matching, history, worker).
• Namespace isolation with separate persistence and visibility stores.

2.3 Data Protection

• In Transit: TLS 1.3 for all external and internal communication.
• At Rest: AES-256 encryption for all persistent stores (PostgreSQL, Cassandra, blob storage).
• Key Management: Customer-managed keys (CMK) supported via cloud KMS integration.
• Evidence Packages: Cryptographically sealed (SHA-256 receipt root). Tamper-evident by design.

3. Application Security

3.1 Zero-Trust Identity

• Principal attribution on every workflow start via constitutional interceptors.
• No anonymous execution — every workflow carries identity, policy snapshot, trust profile.
• OIDC/OAuth2 integration for human and service identities.
• Short-lived credentials; no long-lived API keys in platform code.

3.2 Policy Decision Point (PDP)

• Single PDP authority engine (OPA/Rego) with four frozen constitutional gates.
• Real-time policy evaluation with explicit allow/deny and reason codes.
• Policy versioning with constitutional review required for changes.
• Tenant isolation with optional cross-tenant federation.

3.3 Supply Chain

• All dependencies pinned with lockfiles; automated dependabot updates with PR review.
• SBOM (Software Bill of Materials) generated for each release.
• Container images signed with cosign; verified on deploy.
• No unpinned or unmaintained dependencies in production paths.

4. Operational Security

• Access Control: Least privilege, just-in-time access, MFA required for all engineers.
• Secrets Management: No secrets in code or config. Cloudflare Workers secrets / cloud KMS only.
• Logging & Monitoring: Structured JSON logs; 13-dimension health observability; alerting on anomalies.
• Incident Response: Defined runbooks; 24/7 escalation for P0; postmortems within 5 business days.
• Backup & Recovery: Automated backups with point-in-time recovery; RPO < 5 min, RTO < 30 min for platform metadata.
• Change Management: All changes via PR with CI gates; constitutional review for governance changes.

5. Evidence & Auditability

Our security model is evidence-first. Every platform execution produces a sealed evidence package containing:

• Receipt (workflow status, timing, activities)
• Replay ID for deterministic verification
• Complete workflow history (events, signals, queries, updates)
• Activity manifest with durations and statuses
• OpenTelemetry trace (full span tree)
• Metrics snapshot
• Policy snapshot at execution time
• Identity & provenance chain
• Constitution verdict (all gates PASS/FAIL with scores)

Independent auditors can replay any execution using only the evidence package — no access to original infrastructure required. See Evidence Registry.

6. Compliance Status

As of October 2026:

7. Responsible Disclosure

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

7.1 How to Report

Email [email protected] with:

• Description of the vulnerability and impact
• Steps to reproduce (or proof-of-concept)
• Affected component(s) and version(s)
• Your contact information for follow-up

7.2 Our Commitment

• Acknowledge receipt within 2 business days.
• Provide initial assessment within 10 business days.
• Coordinate disclosure timeline (typically 90 days for non-critical, sooner for critical).
• Credit researchers who follow this process (unless anonymity requested).

7.3 Scope & Rules

• In Scope: aiftrust.us, *.aiftrust.us, Platform APIs, Worker Functions, evidence package verification.
• Out of Scope: Cloudflare infrastructure (report to Cloudflare), third-party dependencies (report to maintainer), social engineering, physical security.
• Prohibited: Accessing/modifying data not yours, DoS testing, automated scanning without permission, testing on customer environments.

8. Security Headers (Website)

The following headers are set on all website responses:

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://api.aiftrust.us; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin

9. Contact

Security questions or concerns:

• Email: [email protected]
• PGP Key: Available on request (fingerprint: A1B2 C3D4 E5F6 7890 ABCD EF12 3456 7890 ABCD EF12)