BreachClock Security Trust Center

Controls that are in the product today. Items not listed here are not implied.

• Role-based access control
• Tenant-isolated data access
• Server-side authorization on mutations
• No service-role key in the browser
• Append-only activity timeline
• Sensitive request bodies are not logged
• Human review before clocks are accepted
• No raw PHI fields in the data model
• Authenticator-app multifactor authentication, including an organization-required MFA policy
• Invite-only member join with work-email invitations
• Minimum password length and compromised-password blocking
• Self-serve workspace creation and Stripe-hosted billing
• In-app support tickets
• Counsel and internal review overlays on the rule library
• Idle session timeout after 15 minutes of inactivity
• Account lockout controls

Matter records are isolated by tenant. Enter incident metadata only — discovery time, role, data types, encryption status, estimated impact, and jurisdictions. Do not enter patient names, medical record numbers, or other raw PHI.

• Tenant-isolated database access
• Restricted access to matters by organization membership and role
• Incident metadata only — not patient records
• No raw PHI fields in the data model
• Encrypted connections in transit for hosted deployments
• Provider-supported encryption for stored data
• Organization export and offboarding request
• Retention and deletion follow the customer agreement after confirmed offboardingIn progress

BreachClock uses a layered vulnerability-management process across source code, dependencies, secrets, application security, and independent testing.

• GitHub Dependabot for dependency alerts
• GitHub CodeQL for static analysis
• GitHub Secret Scanning
• Vercel Web Application Firewall
• Security advisories from infrastructure providers
• Dynamic web application scanningPlanned
• Independent third-party penetration testingPlanned

Production runs on Vercel with a hosted Supabase database. Provider backups are in use. Point-in-time recovery and a published restoration drill remain planned.

• Hosted application deployment on Vercel
• Hosted Supabase database with provider backups
• Application deployment resilience
• Point-in-time recoveryPlanned
• Documented recovery proceduresPlanned
• Backup restoration testingPlanned

BreachClock can draft assessment briefs from structured matter facts. A brief is decision support only. It is not a breach determination and is never auto-approved. The local demonstration provider is not a paid-plan feature.

• Assessment briefs are generated only when a user runs them
• AI keys stay on the server; they are not shipped to the browser
• AI output is not treated as a decision until a person reviews it
• Production assessments currently use the local demonstration provider and do not send matter data to a hosted model
• Transactional email through Resend
• Hosted AI processing by an approved providerPlanned

A short view of how BreachClock treats incident metadata and privileged access.

• Customer data is logically isolated by organization
• Matter records are not publicly accessible
• BreachClock is not intended for patient names or other raw PHI and is not a HIPAA certification
• Restricted security materials are shared only through approved access
• Public legal policies and a subprocessor list
• Approved production subprocessors for hosting, authentication, AI, email, and billing

These are materials we can discuss with approved reviewers. A status of Planned means the artifact does not exist yet and is not available to download.

Current

• Security OverviewAvailable on request
• Architecture OverviewAvailable under NDA
• Access Control ModelAvailable on request
• Backup OverviewAvailable on request
• Encryption OverviewAvailable on request
• In-app BAA and DPA acceptanceAvailable on request

Planned

• Third-Party Penetration Test SummaryPlanned
• SOC 2 Type II ReportPlanned