Security

Belfry Labs is not ISO 27001 certified and does not hold a SOC 2 Type II report. Atlas can produce framework scorecards for your AI systems. Those scorecards are not a certificate that Belfry Labs operates a certified ISMS.

• No training on customer prompts or repositories.
• Default metadata_only prompt storage (hashes, not plaintext).
• OIDC SSO, RBAC, tenant isolation, TLS, RDS encryption with KMS.
• Named subprocessors and a data-flow description in the company evidence pack.

The vendor-security binder (use case, data-flow, access matrix, AI data-use, IR, DPA template) lives in the product repository under docs/company-security/. Gaps we will not fake — independent pentest, 24/7 SOC, availability SLA, BYOK, SAML/SCIM — are listed in gaps.md.

Security: security@belfrylabs.ai (business hours). Privacy: privacy@belfrylabs.ai. See security.txt.