Security & compliance

Posture below is generated from deploy/config/compliance.yaml so it reflects what's actually in production.

Launched 2026-06-01.

Baseline controls

gdpr compliant: GDPR compliant by design. DSAR endpoints, sub-processor list, DPA, EU representative engaged within 30 days of first EU customer.; Region: eu-central-1 model plane
popia compliant: POPIA compliant by design. Tenant data resident in af-south-1. Information Officer registered with the SA Information Regulator.; Region: af-south-1 tenant plane
encryption at rest enabled: AWS KMS-managed keys for tenant Postgres, Qdrant volumes, and S3 buckets. Per-tenant KMS key for any collection with special_pi=true.
encryption in transit enabled: TLS 1.3 on every public endpoint. Linkerd mTLS on every pod-to-pod hop, including cross-region inference path.
breach notification ready: 72-hour breach notification pipeline. Audit categories isolation_violation_detected, unauthorised_access, data_exfiltration_attempt auto-trigger runbook.; SLA: 72 hours

soc2 type2 observation in progress: SOC 2 Type II observation period began at launch. Full report available month 12.
iso27001 stage 1 evaluation: ISO 27001 Stage 1 evaluation in progress for EU customers. Full certification a year-2 milestone if EU pipeline justifies.
pen test completed: External pen test #1 completed pre-launch. Next test scheduled month 9.
bug bounty scheduled: Private bug bounty programme launches month 6. Public bounty consideration at month 12.

Pod-namespace tenant ID. Tenant ID is derived from the pod's namespace at boot, never from a request parameter.
Stateless model plane. No prompt content is persisted. Audit logs store hashes + token counts only.
Cross-tenant cache off. vLLM cross-tenant prefix caching is disabled by default; re-evaluation gated on SOC 2 Type II.
Belt-and-braces retrieval. Qdrant collections are physically separate per (tenant, collection) and every query filters by tenant_id payload.
Internal email + password authentication. Argon2id-hashed, NIST 800-63B policy, account-enumeration-safe responses, 5-strike soft lockout. No SSO; the credential store is owned by feder8d, never a third party.

Full security architecture, current control inventory, and audit evidence available under NDA upon request.

Request access by emailing security@feder8d.ai.

Email security@feder8d.com. We acknowledge within 24 hours and accept private disclosures via our (invitation-only) bug bounty programme.