Security, written up for reviewers

Workloads run in their own microVMs, each class documented with what it proves and what it does not. The planned six-part design for governed work (observe, decide, approve, execute, log, anchor) is drawn below.

EU-region cells for EU clients. A data processing agreement template, records of processing, and a sub-processor list with change notification are in preparation; the region policy is in force from phase 0 of the first enterprise delivery.

Logs are write-once, and their roots are to be anchored on Base, so anyone can check the records without trusting Taifoon: fetch the record, recompute the root, compare it with the one on chain. The anchor cadence figure will appear here the day the status page serves it; it is not typeset by hand.

A vault policy model with no standing keys in runtimes. Admin access reviews run on a stated cadence beginning with the first enterprise tenant, and the break-glass procedure is itself logged like everything else.

ISO 27001 and SOC 2 Type II are roadmap entries with gate dates; the certifying body is named once engaged. We publish the roadmap rather than the claim. Nothing in this section implies possession.

External testing per major release and at least annually; a summary is published, the full report is available under NDA. The first test is scheduled inside phase 3 of the first enterprise delivery.

Reports go to info@taifoon.io. Acknowledgement within two business days; fix targets by severity; public credit for reporters who want it.

A severity ladder with notification windows aligned to NIS2 reporting duties, a named-role on-call, and post-incident reports published to affected clients. The procedure is written; it is tagged LIVE after the first drill, which is itself logged.

Recovery objectives per plane and a degradation ladder: observation continues when actuation is paused, and the log never pauses. An annual restore test is part of the procedure.

NIS2: our own scope, and separately the evidence packs we generate for clients’ obligations. EU AI Act: the approval ladder is documented as the human-oversight mechanism for high-consequence actions, with model and system documentation per workload. GDPR: we are processor for tenant data and controller for our own telemetry. This mapping is documentation, not legal advice; counsel review is pending.

Every public claim this company makes is tagged, and claims that failed verification are retracted in place rather than quietly dropped. The register is public: the claims register →