Trust Center & Operational Security
All verifiable technical information required for enterprise vendor security assessments (CISO, DPO, SecOps): exact certification status, EU sovereign data residency, authorized subprocessors, and responsible disclosure policy.
EU AI Act (Articles 12 & 14)
Automated event recording for AI agent actions (Article 12) with instant kill-switch quarantine and human-in-the-loop oversight capabilities (Article 14).
GDPR & Crypto-Shredding
Strict data minimization by default (content digests instead of raw payload). The right to erasure is honored via per-org cryptographic key destruction (crypto-shredding) without breaking the audit chain.
SOC 2 Type II
SOC 2 Type I readiness underway, preceding the formal Type II observation period. We never claim unissued or pending certifications as completed.
ISO / IEC 27001
Security policy mapping based on Annex A controls (access control, cryptography, operations logging, network segregation). Formal certification is scheduled on our roadmap.
Authorized Subprocessors
Boundry selects and audits all cloud hosting and third-party vendors according to strict European residency and enterprise security standards.
| Subprocessor | Service & Purpose | Location |
|---|---|---|
| Render Services Inc. | SecOps Dashboard and API Gateway Hosting | Frankfurt, Germany (EU) |
| Neon Inc. (Databricks) | Managed PostgreSQL database with volume-level encryption | Frankfurt, Germany (EU) |
| Paddle.com Market Ltd | Merchant of Record (Billing, global payment and VAT compliance) | UK / EU (Adequacy Decision) |
| Resend Inc. | Transactional security alerts & MFA token delivery | EU / Standard Contractual Clauses |
Data Residency & EU Sovereignty
All production application instances and primary databases are located exclusively within the European Union in Frankfurt, Germany (region eu-central-1).
- Strict TLS 1.3 encryption in transit
- AES-256 volume encryption at rest
- Zero customer payload used for model re-training
Vulnerability Disclosure (RFC 9116)
We operate a public coordinated vulnerability disclosure program under RFC 9116 available at /.well-known/security.txt.
Security team contact: [email protected] (acknowledged within 48 business hours).
Penetration Testing & Uptime
Continuous automated multi-tenant isolation unit tests running on each build. First comprehensive external third-party penetration test (grey-box) scheduled for Q1 2027.
Real-time gateway status: /health (Operational).
Verify log integrity without trusting our cloud
Every recorded action is chained via SHA-256 and signed. Download our standalone open-source verification CLI script boundry_verify.py (Apache 2.0 license) and verify your exported log trails directly on your local infrastructure without any external API calls.