Trust Center
Last Updated: August 20, 2026
Everything a security or procurement reviewer needs, in one place. We publish what we actually do — including what we do not do — and every claim on this page points at the control behind it.
Our compliance posture, stated plainly
Demeterics has not engaged a third-party auditor. We maintain the control set a SOC 2 Type II audit examines — written policies, incident response, change management, vendor assessment, data classification — and we assess ourselves against it and publish the result, including the gaps. Our most recent internal assessment (March 2026) scored 52/100 against SOC 2 common criteria. We will engage an auditor when customer demand justifies the cost.
We would rather tell you that than let you discover it during a security review.
Zero-Day Retention
The strongest privacy guarantee we offer is that we do not keep your data at all.
With Zero-Day Retention enabled on an API key, prompt and response content is never written to storage. We retain only content hashes (a SHA-256 payload digest plus per-message MD5 digests), token counts, cost, latency, model name and timestamp — enough to bill you and show you your usage, and nothing more.
This is enforced at ingestion, in code — not by a retention policy that deletes data later. A breach, a subpoena, or a rogue employee cannot surface content that was never stored.
Retention is configured per API key, so a single account can run zero-retention keys for sensitive workloads alongside longer-retention keys for debugging:
- 0 days (ZDR): content never stored
- 30 days: content deleted by an automated daily job
- 90 days (default): content deleted by an automated daily job
- 365 days: content deleted after one year
- On demand:
DELETE /api/v1/datadeletes your content immediately
What we have
| Control | Status | Detail |
|---|---|---|
| Zero-Day Retention | Shipped | Enforced at ingestion; per-API-key |
| Configurable retention + automated deletion | Shipped | Daily cron; 0/30/90/365 days per key |
| GDPR deletion & export | Shipped | DELETE /api/v1/data, export to CSV/JSON |
| Encryption in transit & at rest | Shipped | TLS 1.3; AES-256 at rest |
| Provider key encryption | Shipped | Cloud KMS, 15-minute in-memory cache, every decrypt audit-logged |
| Bring-your-own-key, never persisted | Shipped | Transient dual-key mode — your provider key is used and discarded |
| API key hashing | Shipped | bcrypt, cost factor 12 |
| Tenant isolation | Shipped | user_id filtering on every query |
| Written security policies | Shipped | Incident response, risk register, change management, data classification, vendor management, secret rotation, security training, hardening roadmap |
| Incident response plan | Shipped | P1–P4 severity matrix, named incident commander, 72-hour breach notification |
| Automated security scanning in CI | Shipped | Secret detection and public-claims accuracy block the build; dependency, static and container scanning run on every change as advisory checks |
| Internal security audit | Shipped | Most recent August 2026: nine findings identified, fixed, deployed and re-verified in production |
| Coordinated vulnerability disclosure | Shipped | security.txt, 2-business-day acknowledgement |
| Subprocessor transparency | Shipped | Full list published, 30-day change notice |
What we do not have
A trust page that lists only strengths is not a trust page. These are the gaps a reviewer would find anyway, so we list them ourselves, with where they stand.
| Item | Status | Position |
|---|---|---|
| SOC 2 Type II certification | Not certified | No auditor engaged. Our internal control set and self-assessment are available in the security package. |
| ISO 27001 / ISO 42001 | Not certified | Not pursued at this stage. |
| Third-party penetration test | Planned | Not yet performed. Internal adversarial audits are performed and documented. |
| HIPAA BAA | Not offered | We do not sign BAAs and Demeterics should not be used for PHI. |
| EU / APAC data residency | Not offered | All data is processed in us-central1 (United States). |
| Enterprise SSO (SAML/SCIM) | Planned | Authentication is Google OAuth2 today. |
| Organisation / team accounts | Planned | Accounts are currently per-user. |
| Contractual SLA | Not offered | The service runs on a best-effort basis. See Terms §9. |
| Public status page | Planned | Service notices are emailed to affected accounts. |
| Paid bug bounty | Not offered | We run a coordinated disclosure program instead. |
Published documents
- Security overview — architecture, encryption, access control, retention
- Privacy policy — what we collect, why, and for how long
- Subprocessor list — every third party that may process your data
- Ethics & acceptable use — what we will not build or allow
- Terms of service
- security.txt — machine-readable disclosure policy
Request our security package
For a vendor security review we provide, on request: a security whitepaper with control-level evidence, a completed CAIQ-Lite questionnaire, a Data Processing Agreement template with Standard Contractual Clauses, our incident response summary, and a dated compliance roadmap.
We respond within 2 business days. We use your details only to send the package and to follow up.
Security contact
Vulnerability reports: security@demeterics.com
(see security.txt).
Everything else: support@demeterics.com.