TRUST CENTER · LAST UPDATED 2026-05-12
Security as a board-level concern. Engineered to the SOC 2 Type II bar by default, not retroactively.
ScyAI builds the world's leading risk intelligence software. We work with customers in the most secure and highly-regulated industries and build software for their most sensitive data.
ScyAI cares deeply about the security outcomes of our customers, and we're committed to transparency about our security practices and program. We stand resolute in continuously improving our security, data protection, and privacy controls to give you the most effective means of protecting your data possible.
Every claim here is grounded in version-controlled policy under docs/soc2/, infrastructure-as-code under infra/, or an operational runbook under docs/runbooks/.
Every technical control listed below is live in production.
The remaining gap to formal certification is the audit observation window itself — not remediation.
Eight families of technical control.
Each live in production today.
Architecture and code are the source of truth — every category below maps to versioned policy, Terraform, and a runbook. Click any card to read the underlying mechanism.
Sixteen formal policies. Signed by the CEO. Version-controlled.
All policies live under docs/soc2/ and are mirrored to Notion. The codebase is the source of truth; Notion is the collaboration and auditor-access surface. Sensitive documents are released under NDA.
Seven security investments shipped in the last quarter.
We treat security as engineered scope, not a project that ends. Below is what shipped recently — each tied to a specific failure mode we wanted to remove from the system.
Outstanding items. We'd rather name them now than answer them later.
A SOC 2 review will surface gaps. These are the items we know about, and our plan for each.
DR / business continuity tabletop
Scheduled. Recovery procedures documented in runbook; live exercise pending the start of the audit observation window.
Customer-Managed Encryption Keys (CMEK)
On roadmap. Inherited Google-managed encryption meets the SOC 2 bar; CMEK is for customers with stricter key-control requirements.
Independent penetration test
Scheduled before audit engagement. Internal threat-model and code review ongoing.
Auditor engagement
Scope drafted. Shortlist of three auditors under evaluation; engagement targeted this quarter.
Vendors and AI providers. Tracked, classified, reviewed.
All AI providers operate under zero-data-retention contracts. The full vendor register, with criticality ratings and data-handling classification, is available on request.
Google Cloud Platform
Primary infrastructure — Firestore, GCS, Cloud Run, BigQuery, Secret Manager, Identity Platform.
OpenAI
LLM inference for agent workloads. Zero-data-retention.
Anthropic
LLM inference for agent workloads. Zero-data-retention.
Google (Gemini)
LLM inference. Zero-data-retention.
GitLab
Source control + CI runner. No customer data.
Mapbox
Geospatial tiles + geocoding. Aggregate request data only.
Cityweft
Specialised geo-risk lookup. TLS only.
E2B
Code execution sandbox for agent tasks. Ephemeral.
Resend
Transactional email for security@scyai.com enquiries. No customer data.
What's changed.
Material changes to our security posture, posted as they ship.
SOC 2 Type 1 — auditor shortlist finalised, engagement targeted this quarter.
Sixteen formal policies are signed by the CEO and on a six-monthly review cycle. Every technical control listed in this Trust Center is live in production today; the remaining gap to formal certification is the audit observation window itself.
Cross-tenant administrator access hardened with dual-attribution audit and per-request MFA.
Platform administrators authenticate through a dedicated scyai-internal Firebase tenant — separate from any customer tenant. Cross-tenant operations now require a per-request opt-in via signed headers and pass an MFA + active-membership check at the middleware layer. Every event is logged at warn level with actor user id, target tenant, target user, request path, and request id.
Workload Identity Federation attribute conditions tightened across all environments.
The WIF provider's attribute condition now enforces four invariants before issuing a token: project, ref equals main, ref type is branch (not tag), and namespace is scyai-prod. Feature-branch and tag pipelines cannot obtain deployer credentials.
365-day immutable audit log retention now live across all environments.
An organisation-level GCP log sink streams every audit, Cloud Run, and HTTP load balancer log line to a dedicated central-logging GCP project. The log bucket has retention lock — logs cannot be deleted before expiry. Logs are streamed into a BigQuery dataset with SQL access for forensics, compliance evidence, and dashboards.
What customers and auditors ask first.
The questions our customers and their auditors ask most — answered the way our engineers would explain them, not the way marketing would.
We are SOC 2 Type 1 audit-ready now. Sixteen formal policies are signed, all controls are operating in production, and evidence is assembled. Auditor selection is in progress and engagement is targeted within the current quarter. SOC 2 Type 2 follows directly — the observation window opens the day Type 1 closes. Because every technical control is already live, the Type 2 window is observation, not remediation.