Trust & Security Center

Last Updated: March 11, 2026

Security architecture, certifications, data protection measures, and trust documentation for enterprise procurement teams and security reviewers.

ðŸ”

AES-256

Encryption at rest

ðŸ”’

TLS 1.3

Encryption in transit

âœ…

SOC 2 Type II

Infrastructure

âœ…

SOC 2 Type II

Database

Certifications & Compliance Status

SOC 2 Type II— Infrastructure (AWS) — ECS Fargate, RDS PostgreSQL, S3

Certified via infrastructure provider

Dr. Carlo Honrado deploys on Amazon Web Services, which is SOC 2 Type II certified. Dr. Carlo Honrado corporate SOC 2 Type II audit: in preparation, target Q4 2026.

ISO 27001— Information security management

In progress

Gap assessment complete. Remediation in progress. Target certification: Q1 2027.

ISO 42001— AI Management Systems

Gap assessment planned

ISO 42001 is the AI-specific management systems standard. Gap assessment scheduled for Q3 2026.

HIPAA BAA— Healthcare deployments (Foresight)

Available upon request

Business Associate Agreements are available for covered entities and business associates requiring HIPAA compliance. Contact us to initiate BAA execution before deploying Foresight in a HIPAA-covered environment.

21 CFR Part 11— Foresight — pharmaceutical deployments

Validation documentation available

Foresight includes a validation documentation package (URS, FRS, IQ/OQ/PQ templates, 21 CFR Part 11 compliance matrix, audit rights SLA). Dr. Carlo Honrado supports Computer Software Assurance (CSA) processes. Client validation execution is the client's responsibility.

EU AI Act— All products — EU-connected customers

Compliance in preparation

EU AI Act high-risk provisions effective August 2, 2026. Technical documentation in preparation. Foresight identified as requiring full high-risk compliance assessment. Other products assessed as Limited Risk. Enterprise customers requiring EU AI Act documentation contact us.

GDPR— All customers with EU data subjects

DPA available — SCCs included

GDPR-compliant Data Processing Addendum (DPA) available with Standard Contractual Clauses (SCCs) for international data transfers. See /legal/dpa.

CPRA (California)— All customers with California data subjects

Compliant

Privacy Policy updated March 2026 to include California Consumer Rights section, Notice at Collection on all forms, and Do Not Sell/Share mechanism.

Infrastructure Overview

Cloud provider

Amazon Web Services — ECS Fargate, RDS PostgreSQL, S3, CloudFront

Primary region

United States (us-west-2)

Data residency

United States (default). EU data residency available for enterprise customers — contact us.

Encryption at rest

AES-256 for all data at rest in AWS RDS PostgreSQL and S3

Encryption in transit

TLS 1.3 for all connections. HSTS enforced.

Token encryption

AES-256-GCM with unique IV per token (OAuth access tokens for LinkedIn and Gmail)

Database isolation

Per-tenant row-level security and environment isolation. Admin and user data strictly separated.

Access control

Role-based access control (RBAC). Multi-factor authentication required for all admin access. Principle of least privilege enforced.

Backup frequency

Automated daily database backups with point-in-time recovery (AWS RDS Multi-AZ)

Uptime target

Website: 99.9% (AWS SLA). Enterprise product SLAs defined in Order Forms.

CDN / DDoS protection

AWS CloudFront with built-in DDoS mitigation

Rate limiting

Applied to all public API endpoints. Configurable per-customer for enterprise deployments.

Security Controls

Application Security

âœ“Admin session management with JWT + database-backed session validation
âœ“CSRF protection on all state-changing endpoints
âœ“Input sanitization and output encoding
âœ“SQL injection prevention via parameterized queries (AWS RDS PostgreSQL)
âœ“Dependency scanning in CI/CD pipeline
âœ“Security headers (HSTS, CSP, X-Frame-Options)

Access Management

âœ“Multi-factor authentication (MFA) required for all admin accounts
âœ“Session timeout and revocation capability
âœ“Admin access logging with cryptographic evidence chain
âœ“No shared credentials — individual accounts per operator
âœ“API key rotation schedule
âœ“Third-party OAuth tokens encrypted AES-256-GCM at rest

Monitoring & Incident Response

âœ“Security event logging across all services (12-month retention)
âœ“Anomaly detection on admin API access
âœ“Automated alert on failed authentication attempts
âœ“Incident response plan with documented 72-hour GDPR notification SLA
âœ“On-call security escalation path
âœ“Post-incident root cause analysis process

Development Practices

âœ“Code review required before production deployment
âœ“Secrets management via environment variables (never in source code)
âœ“Git repository access controls and audit logging
âœ“Staging environment separate from production
âœ“Automated test suite with security test coverage
âœ“Third-party penetration testing (annual schedule)

Vulnerability Disclosure Policy

Dr. Carlo Honrado welcomes responsible disclosure of security vulnerabilities. We are committed to working with the security research community to identify and address security issues promptly.

In Scope

drhonrado.com and all subdomains
Public-facing APIs (api.drhonrado.com and /api/* routes)
Authentication and session management systems
Data storage and transmission security

Out of Scope

Third-party service providers (AWS, OpenAI, etc.) — report to them directly
Denial of service (DoS) testing
Social engineering attacks on Dr. Carlo Honrado employees
Physical security
Client environments or data belonging to other customers

Safe Harbor

Dr. Carlo Honrado will not pursue legal action against security researchers who discover and report vulnerabilities in good faith, provided they: (1) do not access or modify data beyond what is necessary to demonstrate the vulnerability; (2) do not exploit the vulnerability for malicious purposes; (3) report promptly and maintain confidentiality until remediated; and (4) do not engage in denial of service, phishing, or social engineering.

How to Report

Email:

Subject line: "Security Vulnerability Report"

Include: Description of the vulnerability, steps to reproduce, potential impact, and your contact information

Encryption: For sensitive reports, request our PGP key before submission

Response Commitments

Acknowledgment of receipt: within 3 business days
Initial assessment and severity classification: within 7 business days
Regular status updates during investigation
Public disclosure: coordinated with researcher, typically 90 days after patch availability
Credit to researchers in our release notes (if desired)

Incident Response & Notification

In the event of a security incident affecting personal data, Dr. Carlo Honrado commits to:

Detecting and containing incidents through continuous monitoring
Notifying affected enterprise customers within 72 hours of confirming a breach (GDPR Article 33 requirement)
Notifying California residents per California Civil Code § 1798.82
Conducting a post-incident root cause analysis and providing a written summary to affected customers
Maintaining a record of all security incidents, their scope, and remediation actions

Enterprise customers may request our Incident Response Plan (IRP) document under NDA. Contact with subject line "IRP Documentation Request."

Security Contact

General security inquiries: — subject: "Security Inquiry"

Vulnerability reports: — subject: "Security Vulnerability Report"

Data breach notification: — subject: "Security Incident"

DPA / HIPAA BAA requests: — subject: "DPA Request" or "BAA Request"