Security and compliance at anturno
Where we stand on each framework, what we commit to, the documents you can request, who processes your data, and how to report a security issue.
Where each framework stands
No audit has taken place yet.
| Framework | Status | Note |
|---|---|---|
| SOC 2 Type I | No auditor engaged yet. | |
| SOC 2 Type II | The Type II examination covers an observation window once an auditor is engaged. No auditor engaged yet. | |
| ISO 27001 | An ISMS scope and a statement of applicability are in the repository. No certification body engaged yet. | |
| GDPR | No third party has checked it. A data processing agreement is available on request. | |
| CCPA | No third party has checked it. | |
| HIPAA | There is no HIPAA program. Do not send protected health information to the service. |
- Preparing
- Work toward an audit has started. No auditor is engaged.
- Self-assessed
- We assessed it ourselves. No third party has checked it.
- Not pursued
- We are not working toward it.
How the product is run
Short statements of work that is in place. The detailed register stays in the repository.
Encryption
Secrets are encrypted per workspace. Traffic to the product uses TLS. Model keys do not enter the session sandbox.
Access
Sign-in and scoped tokens govern who can use the product. Every member of a workspace has the same access to it. A person can revoke every session at once.
Isolation
Each session runs in its own microVM. The public API does not send CORS headers, so a web page cannot read its answers.
Change review
Every change to the product goes through a pull request and CI. The factory does not merge a pull request on its own.
Erasure on request
A member can ask us to erase a workspace. We do it by hand, backups included, and confirm by email. The privacy policy says when.
Reporting an issue
Write to the security address to report a vulnerability. The disclosure policy is public and says what we do in return.
The policies behind the product
A policy is listed once it is written. An adopted policy can be requested by email.
Security and IT policies
- Information Security PolicyRequest
- Acceptable UseRequest
- Access ControlRequest
- Change ManagementRequest
- Incident ResponseRequest
- Vulnerability ManagementRequest
- Risk AssessmentRequest
- Vendor / Subprocessor ManagementRequest
- Data Classification and HandlingRequest
- Logging and MonitoringRequest
- Business Continuity / Disaster RecoveryRequest
- People / HR SecurityRequest
Published today
- Vulnerability disclosure policy
How to report a security issue, what we do in return, the scope and the safe harbour.
- Privacy policy
What we collect, why, how long we keep it, how deletion works and who else touches it.
- Data processing agreement
A template with standard contractual clauses for transfers out of the EEA, the UK and Switzerland. Sent on request.
Who processes your data
The list is on its own page: what each service does, which data it touches, and where. A new subprocessor is announced there at least 30 days before it starts processing customer data.
Write to the security address
Plain email is fine. The disclosure policy says what to include, the scope and the safe harbour.
- Security address
- security@anturno.cloud
- Acknowledgement
- Within five business days of your report.
- Disclosure policy
- Vulnerability disclosure