Security and compliance

Data security

Data is encrypted with AES-256 at rest and TLS 1.2 or better in transit. Keys are managed in a dedicated key service with rotation, and access to production data requires a named approval that is itself logged.

• AES-256 at rest
• TLS 1.2 minimum in transit
• Approved, logged production access

Application security

Dependencies are scanned continuously, changes go through review before merge, and we run external penetration testing on a fixed schedule with findings tracked to closure.

• Continuous dependency scanning
• Mandatory review before merge
• Scheduled external penetration testing

Compliance and data protection

We operate under GDPR and CCPA, with ISO/IEC 27001-aligned controls. Lawful basis is recorded per data category and retention is enforced by the pipeline, so data ages out whether or not somebody remembers to delete it.

• GDPR and CCPA workflows
• ISO/IEC 27001-aligned controls
• Retention enforced in the pipeline

Audit and monitoring

Every lookup writes an immutable record tied to the key that made it. Infrastructure and application logs are centralised, alerted on, and retained for the period your agreement specifies.

• Immutable per-call records
• Centralised logging and alerting
• Exportable audit trail

Privacy management

Deletion, correction and opt-out requests propagate through every downstream index rather than stopping at the primary store. We can show you the propagation record for any completed request.

Responsible AI

Models are evaluated continuously against held-out data, and we monitor for drift rather than assuming yesterday's calibration still holds. We do not infer protected characteristics, and we decline use cases we would not defend publicly.

• Continuous evaluation and drift monitoring
• No inference of protected characteristics
• Published acceptable-use policy

Security contact

Report a vulnerability or request our security documentation at info@gscplatform.co. We acknowledge reports within one business day.