Trust center
What we've done, what we haven't yet, and how to check.
Your vendor review deserves straight answers. This page lists our compliance status as it stands today, 21 controls already in place, and live checks against our production sites that you can rerun yourself.
At a glance
Live security checks
These checks run on our server against the live sites when you open this page, and the results are cached for 10 minutes. Anyone can run the same checks with a browser or curl -I.
Compliance status
Preparing controls and evidence against the Trust Services Criteria. We'll publish the report date here once an auditor is engaged.
In progressFollows Type I, once the controls have run over an observation period.
PlannedWe act as a processor for pilot data. A data processing agreement (DPA) is available for pilots and enterprise agreements.
On requestNot started. We'll evaluate it alongside SOC 2 if customers need it.
PlannedNot offered today. Don't submit protected health information to the trial or the demo.
PlannedOut of scope. ProcureAI doesn't store or process cardholder data.
PlannedControls
Grouped the way security reviewers usually ask. Of 30 controls, 21 are in place today. The rest are marked as in progress, planned, or available on request.
Encryption
- All traffic uses TLS. Plain HTTP is redirected and HSTS is enforced.Live check below In place
- The database is encrypted at rest by our managed database provider. In place
- Secrets live in the hosting platform's encrypted environment settings, never in source code. In place
Application security
- Content Security Policy, clickjacking protection, MIME-sniffing protection, and a strict referrer policy on every page.Live check below In place
- Registration, trial, and demo-request inputs are validated against a strict schema before the server uses them. In place
- Trial sessions use signed, HTTP-only cookies. In place
- Rate limits per visitor and per network on the trial and document generator.Live check below In place
- Third-party penetration test. Planned
Access control
- The internal admin console requires sign-in, is hidden from search engines, and its APIs refuse unsigned requests.Live check below In place
- Production access is limited to named Stellitron engineers. In place
- Single sign-on (SAML/OIDC) and role mapping for customer tenants. On request
- Quarterly access reviews, documented. In progress
Change management
- Every change goes through version control, a type check, and a production build before an automated deploy. In place
- Earlier deployments are kept, so we can roll back immediately. In place
- Written change-management policy with peer review recorded for every change. In progress
Data handling and privacy
- The public trial asks for consent and is for dummy or anonymized documents only. In place
- Visitor IP addresses are stored only as salted one-way hashes, used for rate limiting. In place
- Trial records are deleted on request. Email contact@stellitron.com from the address you registered with. In place
- Product demo screens run on synthetic data and are excluded from search indexing.Live check below In place
- Data residency in your region or your own cloud account for pilots. On request
- Automated retention schedule for trial data. In progress
AI governance
- Rules run first. AI assists with extraction and drafting, and every step is shown in the agent trace. In place
- People approve routing, releases, awards, and payments. Agents prepare the work but don't make the final decision. In place
- Every agent action is written to an audit log with a timestamp and a link to its evidence. In place
- We use AI providers whose API terms state that submitted content isn't used for training. Provider names are shared under NDA. In place
Operations
- Hosting and database run on providers that are independently audited (SOC 2 Type II). These are the providers' audits, not ours. We can point you to their reports. In place
- Point-in-time database recovery from our managed provider. In place
- Written incident response plan, with customer notification commitments set out in the DPA. In progress
- Information security policy set, with yearly security training. In progress
- Vendor risk reviews of our own subprocessors. In progress
Documents for your review
How data flows through the agents, where it's stored, and who can access it.
Shared under NDA during evaluation.
For pilots and enterprise agreements.
Your format or a standard one such as SIG Lite or CAIQ.
Available once the audit is complete.
Available once the first third-party test is complete.
Report a vulnerability
Email contact@stellitron.com with the steps to reproduce. We acknowledge reports within two business days. Please don't access other people's data or disrupt the service. We won't take action against good-faith research. Our contact details are also published in security.txt.
Questions
Are you SOC 2 certified?
Not yet. No independent audit has been completed. SOC 2 Type I is in preparation, and this page lists the controls already in place so your team can assess us today.
Can we run a pilot before your audit is done?
Yes. Pilots usually run on synthetic or anonymized data, or in your own cloud account, so your data stays under your controls. We'll complete your security questionnaire and sign a DPA and an NDA first.
Which AI models and subprocessors do you use?
We share the subprocessor list, including AI providers, under NDA during evaluation. Every provider we use states in its API terms that submitted content isn't used for training.
How do I report a vulnerability?
Email contact@stellitron.com with the details. We acknowledge reports within two business days and won't take action against good-faith research that avoids privacy harm and service disruption.
For how the agents handle data, see Security & data.
Running a vendor review?
We'll complete your questionnaire, walk your security team through the architecture, and sign an NDA and DPA for a pilot.