Trust centre

Our real security status, nothing ahead of the certificate.

Enterprise buyers tell us one discovered false claim ends a deal. So this page separates what exists today from what is in progress, with dates.

Request documentsProcurement hub
In place today
In progress
  • Engine guardrails in v0: stop-before-pay, per-origin rate limits, kill switch, Web Bot Auth signing
  • SOC 2 Type I: kick-off Q4 2026, report ≈ month 3
  • Independent penetration test: month 3
  • E&O and cyber insurance with affirmative AI cover: month 2
  • Pre-filled SIG Lite, CAIQ v4, AI-CAIQ, HECVAT: month 4
Planned
  • SOC 2 Type II: months 9-12
  • ISO/IEC 27001: months 12-15
  • ISO/IEC 42001 (AI management): months 15-18
  • HIPAA controls + BAA: month 12 (no healthcare work before then)
  • EU data region: Q1 2027

What you can read now

DPA

SCCs, UK Addendum, DORA clauses.

Learn more →

Sub-processors

Every LLM vendor, region, retention.

Learn more →

AI addendum

No training; model-change notice.

Learn more →

Rules of engagement

What agents may do on your systems.

Learn more →

Payments testing

Stop before pay; test cards only.

Learn more →

Claims policy

Evidence, not badges.

Learn more →

Methodology

How pass / fail is judged.

Learn more →

Accessibility statement

Our own site, honestly.

Learn more →

Security questions

Is alt.qa SOC 2 certified?
No. SOC 2 Type I is in progress (kick-off Q4 2026, report targeted around month 3). Type II follows in months 9-12. Earlier versions of this site claimed SOC 2 Type II. That was wrong, and we removed it.
Do you train AI models on our data?
No. Not us and not our model providers, by contract where they offer it. See the AI addendum.
Where is our data stored?
US by default; EU region is on the Q1 2027 roadmap. Evidence retention is configurable per workspace, including zero-retention.
Can we get a pen-test report?
The first independent penetration test is scheduled for month 3; the summary will be available under NDA here.