Security Overview

Our security program is shaped by four principles:

• Least access. Production systems are accessed by the smallest possible set of people, each with the smallest possible scope, for the shortest possible time.
• End-to-end encryption.Customer fingerprint payloads are encrypted in the browser with tenant-specific RSA public keys and decrypted only inside SignalGate's production boundary. Operators cannot read payloads without a key-rotation event.
• Defence in depth. Network, identity, application, and data layers each have their own controls; no single failure should compromise customer data.
• Document what we do. Controls live in written runbooks, not in our heads. The runbooks are available to auditors under NDA.

• Hosting: AWS Frankfurt region (eu-central-1). All production workloads run on ECS Fargate; data stores are RDS Postgres, Redis (ElastiCache or self-managed), and ClickHouse.
• Network isolation: production VPC, private subnets for data stores, security groups scoped per service, no public ingress except the public API and dashboard via TLS-terminated load balancers.
• DDoS: AWS Shield Standard is enabled by default; rate-limiting at the API edge protects against volumetric abuse.

In transit: all API and dashboard traffic uses TLS 1.2 or higher. Internal service-to-service traffic is encrypted via mutual TLS where applicable.

At rest: all data stores use AES-256 encryption with KMS-managed keys. Backup snapshots inherit the same encryption.

Application-layer encryption:fingerprint payloads are encrypted in the browser using each tenant's RSA-2048 public key before transmission. The matching private key is generated and stored server-side and never leaves SignalGate's infrastructure. Customers may rotate keys at any time from the dashboard; old keys remain valid for decryption during a configurable grace window.

• Employee access: SSO through our single sign-on provider with mandatory MFA. Production access is granted on a need-to-know basis, recorded and reviewed quarterly.
• Customer access: dashboard accounts authenticate via password (Argon2-hashed) and short-lived JWTs (15-minute access, 7-day refresh). Role-based access control (Owner / Admin / Member) governs in-dashboard actions. Customer-side MFA, SAML SSO and SCIM are on the roadmap.
• API keys: displayed once at creation; stored as hashes on our side. Revocable from the dashboard at any time. Scoped per tenant.

• Code review for every change reaching main; CI gates on lint and tests.
• Static analysis via the language ecosystem's default tooling (ESLint, ruff, mypy, gosec where applicable); dependency scanning via GitHub Dependabot.
• Secrets are stored in AWS Secrets Manager / Parameter Store and never committed to the repository. Pre-commit scanning catches accidental inclusions.
• Container images are built with hardened base images and scanned before deployment.

• Application and access logs are centralised and retained for 12 months; longer for security-event logs.
• Anomaly alerts are sent to the on-call channel; the on-call rotation acknowledges within one hour 24/7.
• Customer-facing audit logs of dashboard actions are available via the Events tab in the dashboard.

We maintain a documented incident-response plan covering identification, containment, eradication, recovery, customer notification, and post-mortem. Severity is classified on a four-tier scale; the SLOs for response and customer notification scale with severity.

For Personal Data Breaches affecting Customer Data we will notify Customer in line with our Data Processing Addendum §10.

• Production data stores are backed up daily; backups are tested for restoration on a regular cadence.
• Multi-AZ deployment within the Frankfurt region; multi-region disaster recovery is on the roadmap.
• Recovery-time and recovery-point objectives (RTO / RPO) are documented in our continuity plan, available to auditors under NDA.

If you believe you have found a security vulnerability in SignalGate, please email [email protected] with a clear description and reproduction steps. We commit to:

• Acknowledge receipt within 2 business days.
• Provide an initial assessment within 5 business days.
• Keep you informed of remediation progress and credit you (where you wish) in our public advisory.

We ask that you give us a reasonable opportunity to remediate before any public disclosure, do not access or modify data beyond what is necessary to demonstrate the vulnerability, and do not run automated scans without prior coordination.

The current security program is reasonable for a fast-moving startup but is not yet certified. Planned milestones:

• SOC 2 Type I attestation — planned.
• SOC 2 Type II attestation — to follow.
• ISO/IEC 27001 certification — under evaluation.
• Customer-specific compliance questionnaires are answered on request — write to [email protected].