Security and AI
What we do, and what we do not have.
Describing only what is true today. Where something is planned or not held, we say so.
In place today, on our own products
- macOS software signed with a Developer ID and notarized by Apple
- Installers checked by a published SHA-256 checksum and delivered by private, expiring links
- A software bill of materials and a network-observation report for Looking Glass
- Automated tests that fail the build if network code or a dependency is added
- A vulnerability disclosure policy and a security contact
- Email authentication (SPF, DKIM and DMARC) on our domains
Commitments on client work
- We sign your confidentiality agreement before you share data
- We draw where your data goes, and agree it with you before building
- Your data is not used to train models
- We tell you which model provider is used before any of your data is sent to it
- Least access: we ask for what the project needs, nothing more
- We delete your data when the project ends, and confirm in writing
How we handle AI
- AI proposes; fixed rules decide what may run
- Anything that changes data or money needs a person’s confirmation
- Test sets are kept apart from tuning, and we report the misses
- We say plainly what a system cannot do, before handover
- We use AI coding tools in our own work and say so; we rely on tests and a written specification
What we do not have
| Item | Status |
|---|---|
| SOC 2 report | Not held |
| ISO 27001 certificate | Not held |
| Third-party penetration test | Not done |
We are a small company. We offer the evidence above and will complete your security questionnaire. If a certificate is a requirement for your project, tell us at the start.
Report a security problem: contact@appvantix.com, subject “Security”. Please do not include real data or credentials.
Start here
Have a questionnaire?
Send it. We will fill it in honestly, including the gaps.