Trust & Security

Company at a glance

Current compliance posture

Security controls (summary)

• Encryption in transit — TLS 1.2+ on every endpoint, HSTS enforced, no plaintext API listeners.
• Encryption at rest — AWS-managed KMS keys on every DynamoDB table and S3 bucket holding customer data.
• Authentication — Partner API keys (32-byte high-entropy, prefixed cat_live_…). HMAC-SHA256 verification for webhook payloads. Per-partner key rotation procedure documented.
• Tenant isolation — Every DynamoDB query is partition-key-scoped to the requesting partnerId. GSI lookups are post-filtered to prevent cross-tenant data leakage even with a forged secondary key.
• Audit trail — Per-partner queryable event log of every state-changing action (merchant create, payment-method add, attempt sealed, signature captured, etc.). Available via GET /v1/audit.
• Webhook delivery — Signed (HMAC-SHA256), automatic retries with exponential backoff (immediate / 30s / 5min), per-attempt headers for idempotent partner handlers.
• Sub-processor governance — Public sub-processor list with 30-day advance notice of changes. View list.
• Logging & monitoring — CloudWatch Logs across all Lambdas with 90-day retention. Alarms on error-rate spikes, dead-letter-queue depth, API 5xx rates, and spend anomalies, routed to an operations alert topic.
• Infrastructure audit trail — AWS CloudTrail enabled account-wide (multi-region, log-file integrity validation) with 365-day retention, independent of application logs.
• Secrets management — application secrets (AI, billing) held in AWS Systems Manager Parameter Store as KMS-encrypted SecureStrings with least-privilege IAM read access; no plaintext secrets in code, configuration, or environment variables. Partner API keys are stored only as SHA-256 hashes.
• Abuse protection — platform-level request throttling at the API gateway plus per-partner rate limits; AWS Shield Standard DDoS protection on every endpoint; failed asynchronous jobs land in dead-letter queues rather than being silently dropped.
• Backups & DR — DynamoDB point-in-time recovery enabled on every table; S3 versioning on document buckets. RTO 4h / RPO 1h. Full plan in our BCP/DR document.

Document library

Request access to confidential documents

For our full Information Security Policy, IR / BCP plans, or completed SIG/CAIQ responses, contact chris.larson@complianceassessmenttool.com. We share under a one-page mutual NDA.

Responsible disclosure

Found a vulnerability? Email chris.larson@complianceassessmenttool.com with reproduction steps. We respond within one business day, do not pursue good-faith researchers, and credit reporters in our public security acknowledgements (with permission).