Information security policy

Implemented

• Per-firm data isolation enforced in the database with forced row-level security; the application database role cannot bypass it. Pre-tenant operations (sign-in, jobs) use a narrow, key-gated system scope.
• Role-based access and optional client-level access limits; administrators must use multi-factor authentication.
• Passwords hashed with scrypt, minimum 12 characters; account lock-out and rate limits on sign-in, sign-up, password reset and email-sending endpoints, backed by shared storage.
• HTTP-only session cookies, CSRF protection, strict trusted-host and CORS settings, secure response headers.
• Single-use, expiring email-verification, password-reset and invitation tokens.
• Uploaded documents are served through short-lived signed links; connector credentials and tokens are encrypted at rest.
• A hash-chained audit log: changes to history are detectable (tamper-evident, not tamper-proof).

Not in place

• No independent security audit, penetration test, SOC 2 or ISO 27001 certification.
• No malware scanning of uploads in the pilot.
• No managed backups, high availability or 24/7 monitoring; the pilot runs on a computer operated by INVICTT AI and depends on it being online.

Incidents

There is no public status page. If INVICTT AI becomes aware of a security incident affecting a firm's data it intends to tell the firm's administrators without undue delay; the formal commitment and timings require approval. To report a vulnerability or concern, use invictt.com/contact.