Security & Trust

Built like infrastructure, not like an app.

Family information is among the most sensitive data in the world. We treat it that way — at every layer, by default.

AES-256encryption at rest

TLS 1.3in transit

99.99%platform uptime

US + EUdata residency

Compliance posture

What we hold today, what we are pursuing.

✓SOC 2 Type II (in progress)✓HIPAA-aligned controls✓GDPR & CCPA✓ISO 27001 roadmap✓NIST 800-53 mapped✓PCI DSS scope-free

Controls in depth

🔐

Each family has its own AWS KMS key. No cross-family key sharing, no master key.

🗝

WebAuthn / Yubikey support for principals and stewards. SMS as last-resort only.

🛡

Vault contents are client-side encrypted. Athena Foundry staff cannot read them, ever.

👀

Every read, write and access is recorded — append-only, family-visible, exportable.

⚖

Inactivity escalates to named stewards. No legal proceeding required.

🌍

Choose US, EU or a dedicated single-tenant deployment for Foundry-tier families.

Operational discipline

✓
Background-checked engineersEvery engineer touching production passes annual checks and signs a stewardship oath.
✓
Annual penetration testingIndependent CREST-accredited firm. Latest report available under NDA.
✓
Bug bountyPrivate bounty program with HackerOne since launch.
✓
Incident response24/7 on-call, 30-minute notification SLA to affected families.
✓
Vendor diligenceEvery sub-processor reviewed annually. Full list available on request.
✓
Right to forgetOne-click cryptographic erasure of an entire family record on request.

Sub-processors

AWSPrimary hosting (us-east-1, eu-west-1)

CloudflareEdge, WAF, DDoS

StripeBilling only — never family data

DatadogAnonymized observability

PlaidRead-only financial aggregation

OpenAI (on-prem option)Optional AI suggestions

A private 30-minute walkthrough. No deck. Just the platform, the Heartbeat, and the questions you have been quietly carrying.