Security

How we protect your data and infrastructure — and where we are on certifications

Honest baseline

We're an early-stage company. We have strong technical controls in production. We do not yet hold SOC 2 Type II, HIPAA BAA, or formal third-party certifications. This page is accurate — the technical controls are real and running. The certifications are in progress. See compliance page for full status.

TLS 1.3 AES-256 at rest Container isolation Audit logs

1. Infrastructure Security

Container Isolation

Each sandbox runs in its own container — separate process namespace, network namespace, and ephemeral filesystem. Tenants cannot affect each other.

Live

AWS Infrastructure

Hosted on AWS (us-west-2). VPC isolation, security groups, private subnets. No traffic crosses tenant boundaries.

Live

Encryption

TLS 1.3 in transit (min TLS 1.2). AES-256-GCM at rest via AWS KMS. Automatic key rotation.

Live

Audit Logging

All API calls, container lifecycle events, and admin actions are logged with user_id, org_id, and timestamp. Retained 90 days.

Live

2. Container Security

2.1 Isolation Model

Each container benefits from multiple isolation layers — all of these are live in production:

Process Isolation: Separate PID namespace per container
Network Isolation: Dedicated network namespace with firewall rules
Filesystem Isolation: Read-only root with ephemeral overlay
Resource Limits: CPU, memory, and I/O constraints enforced
Seccomp Profiles: Restricted syscall access
No Privileged Mode: Containers cannot access host resources

2.2 Image Security

Base images from trusted sources (official Docker images)
Vulnerability scanning with Trivy in CI pipeline
Minimal attack surface — only required packages installed

3. Network Security

3.1 Inbound

AWS Shield (Standard) for DDoS mitigation
Rate limiting at API gateway level
WAF rules for common injection patterns

3.2 Outbound Controls

Egress filtering configurable per sandbox (Enterprise)
DNS logging available

4. Authentication & Access Control

4.1 User Authentication

API key authentication with scoped permissions
JWT tokens with short expiration (15 minutes)
MFA available (TOTP)
SSO (SAML, OIDC) — Enterprise, in progress

4.2 Internal Access

Role-based access control (RBAC) — live
Principle of least privilege applied to all service accounts
MFA required for all team members
Secrets managed via AWS Secrets Manager — not in environment variables

5. Data Protection

5.1 Encryption

In Transit	TLS 1.3 (min TLS 1.2)
At Rest	AES-256-GCM via AWS KMS
Key Management	AWS KMS — automatic annual rotation
Secrets	AWS Secrets Manager

5.2 Data Handling

Sandbox contents are not accessed by staff except for active support requests (with your consent) or active security incidents
Audit logs retained 90 days by default; longer retention configurable
Account deletion triggers secure data removal within 30 days

6. Certifications & Compliance Status

Honest status as of May 2026:

SOC 2 Type II

Controls documentation underway. Audit not yet complete. No report available.

In Progress

GDPR / CCPA

Data subject rights honored operationally. DPA in legal review. No third-party audit yet.

Practices in place

HIPAA / BAA

BAA program not yet available. Do not run PHI workloads until this is in place.

On roadmap

Penetration Testing

Internal testing ongoing. Third-party pentest not yet scheduled.

In Progress

See our compliance page for the full roadmap and detail on each item.

7. Vulnerability Management

Dependency scanning in CI/CD pipeline (Trivy, GitHub Dependabot)
Infrastructure vulnerability scanning — in progress
We patch critical CVEs as quickly as we can — no formal SLA published yet

8. Incident Response

We take incidents seriously. Current capabilities:

On-call rotation for critical incidents (small team — not 24/7 dedicated security staff)
Defined escalation path for security issues
We will notify affected customers promptly for any confirmed data breach
Post-incident reviews for significant events

9. Responsible Disclosure

Found a vulnerability? We want to know.

Email security@ab0t.com
Include "[SECURITY]" in the subject line
We'll acknowledge within 2 business days and keep you updated
We ask for 90 days before public disclosure
We do not have a formal paid bug bounty program yet — but we appreciate the help and will recognize significant findings

Security contact: security@ab0t.com

For urgent issues, include "[URGENT]" in the subject line. We check this daily, and more often when we're heads down on a release.

Last updated: May 2026.