Security
Verified controls and operating boundaries for Matter of Proof.
Security and data handling.
SOC 2 Type II certified — October 2025
ISO 27001 — in progress, expected Q4 2026
AWS hosting — us-east-1 and us-west-2
Encryption — AES-256 at rest; TLS 1.3 in transit
Tenant isolation — logical isolation through TenantID partitioning at the database level
Retention — metadata 3 years; raw evidence logs 1 year or the customer-specific contractual period
RBAC — Viewer, Investigator, Lead, Admin
AI provider — OpenAI GPT-4o through Azure OpenAI Service under an enterprise agreement
Training policy — client data is not used for foundational-model training
Data residency — maintained within the applicable regional AWS boundary
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
Send a security or privacy request.
Your request is stored for team review.
For active vulnerability disclosure, also email [email protected] with details.