Trust Center
Security You Can Verify
Transparency is the foundation of trust. Review our compliance status, security architecture, data handling practices, and subprocessor relationships -- all in one place.
Compliance Status
Certifications and frameworks.
Real-time visibility into our compliance posture. We publish status honestly -- including what is in progress, not just what is complete.
Active SOC 2 Type 1 readiness program: 8 core policies published at panguard-ai/security-policies, real-time subprocessor list, security.txt vulnerability disclosure, and incident response SLA in effect. Vanta / Drata vendor evaluation in progress; CPA engagement and formal attestation target Q4 2026 / Q1 2027.
Sequenced after SOC 2 Type II. ISMS controls being designed alongside Type 1 prep so certification becomes a formalization.
We process minimal personal data (email + workspace name + anonymized telemetry). Data Processing Agreement available on request.
Panguard does not process Protected Health Information. HIPAA-regulated customers should not transmit PHI through Panguard.
Security Architecture
Defense in depth.
Our security model is layered. A failure at any single layer does not compromise the system. Each layer operates independently with its own controls.
Data Layer
- AES-256 encryption at rest (Threat Cloud)
- TLS 1.3 for all data in transit
- Local file permissions (0600) for CLI configuration
- Skill content never leaves your machine unless you opt in
- SHA-256 anonymized fingerprints only when telemetry is enabled
Application Layer
- Input validation and sanitization
- Local configuration file permissions (0600)
- CLI authentication via local tokens
Infrastructure Layer
- Local-first architecture -- all data stays on your machine
- Threat Cloud hosted on SOC 2 Type II certified provider
- Immutable audit log for admin actions (365-day retention)
- Automated dependency vulnerability scanning
- DDoS protection at provider edge
Data Handling
How we treat your data.
Every data handling practice is documented, enforced through policy, and verified through automated controls.
Data Encryption
AES-256 at rest, TLS 1.3 in transit. Local encryption for configuration and credential storage.
Data Residency
All data stored locally on your device. No cloud storage unless you opt in to Threat Cloud.
Data Retention
Configurable retention policies per data type. Automatic purging with cryptographic verification.
Access Controls
File-system permissions restrict access to configuration and data. Runs as unprivileged user where possible.
Audit Logging
Immutable audit trail for all administrative actions. Logs retained for a minimum of 12 months.
Incident Response
72-hour breach notification commitment. Written IR runbook. External tabletop exercises planned alongside SOC 2 Type 1 in Q3 2026.
Subprocessors
Third parties we work with.
We limit subprocessor usage to essential services only. Each subprocessor undergoes security review before onboarding and is re-evaluated annually.
Last updated: May 2026. We notify customers at least 30 days before adding new subprocessors. Subscribe to updates via our GitHub repository.
DATA LIFECYCLE
Data Retention Policy
Clear policies on what data we store and for how long.
Detection events, alerts, and response logs stored locally on your endpoint.
Environment baseline updated continuously. Replaced when new learning period starts.
Anonymized threat signatures only. No PII, no source code, no raw logs.
PDF reports stored locally. Cloud copies (if any) auto-deleted after 30 days.
INCIDENT RESPONSE
Security Incident Process
Our commitment to transparency when things go wrong.
Detection
< 1 hourAutomated monitoring detects anomalies. On-call engineer alerted.
Assessment
< 4 hoursSeverity classification. Affected users identified. Containment initiated.
Notification
< 24 hoursAffected customers notified via email. Status page updated. Regulatory bodies informed if required.
Remediation
< 72 hoursRoot cause identified and fixed. Patches deployed. Post-mortem published.
Need compliance documentation?
Request SOC 2 reports, penetration test summaries, or our Data Processing Agreement. All documentation is available to the community.