Compliance & Security

Security architecture

Every customer receives a fully isolated, dedicated environment. All requests are verified using cryptographic identity before reaching any platform service. The architecture is built on zero trust principles: default deny, explicit identity, and continuous verification.

• Tenant isolation. Each Customer Environment runs in a dedicated private Kubernetes cluster. No cross-tenant data or workload access is possible by design.
• Encryption. All data is encrypted at rest (AES-256) and in transit (TLS 1.3 / mTLS) using keys you own and control. Signed-I/O cannot decrypt your data.
• Identity. User identity is established by SSO, OIDC, or SAML at the edge. MFA is enforced by policy. All workloads carry cryptographic identity via short-lived certificates.
• Zero trust enforcement. Every request is authenticated and authorized before it proceeds, at every layer. No implicit or ambient trust.
• Signed audit trail. All critical events produce tamper-evident, cryptographically signed, append-only audit records. Export available via API in JSON and CSV.
• Key management. Keys are stored in HSM/KMS infrastructure and never leave protected boundaries. Signed-I/O cannot recover lost keys. Keys rotate automatically per your policy.

No shared inference

Signed-I/O does not subcontract AI inference to third parties. All model inference runs within your isolated Customer Environment. Your prompts and outputs never leave your environment and are never used to train shared models.

Compliance certifications

Audit reports and control mappings are available under NDA via compliance packs (Enterprise required).

Incident response

Continuous monitoring via signed audit logs and automated alerting. Customers are notified within 72 hours of a confirmed data breach. Responsible disclosure: security@signed-io.com — acknowledgment within 48 hours.

Vulnerability management

Regular third-party security assessments and penetration tests. Patch SLA: P1 within 30 days, P2 within 60 days, P3 within 90 days.

Subprocessors

Signed-I/O engages the following third-party subprocessors to deliver the platform. All are bound by the same data use restrictions described in the Data Processing Addendum. Signed-I/O will provide at least 30 days written notice before adding or replacing a material subprocessor. Customers may object within 15 days.

Subprocessor	Country	Purpose	Data types
Cloudflare, Inc.	USA	Zero trust edge access, DDoS mitigation, network routing, TLS termination	Network metadata, authentication tokens, request logs
Amazon Web Services	USA	Cloud compute, storage, managed services	Customer Environment data (encrypted at rest with customer-owned keys), configuration metadata
Microsoft Azure	USA	Cloud compute, storage, managed services	Customer Environment data (encrypted at rest with customer-owned keys), configuration metadata
Google Cloud Platform	USA	Cloud compute, storage, managed services	Customer Environment data (encrypted at rest with customer-owned keys), configuration metadata

A Customer Environment runs on one cloud provider at a time, established at provisioning. Migration to a different provider is an account-level administrative action. Customer data remains encrypted with customer-owned keys throughout.

Security contact: security@signed-io.com