Security

Prefer coordinated disclosure. Email findings (with repro steps and impact) to:

[email protected]

• Do not exploit beyond proof of concept on production tenants you do not own
• Do not access or modify other customers' data
• Allow a reasonable window for remediation before public disclosure

A signed verdict is only worth what the evidence behind it is worth, so the custody of that evidence is stated rather than implied.

• What is held. For each certification run: the artifact digest, the hash-chained evidence log, the environment identity digest, and the signed verdict envelope (Ed25519) with its key id and issue/expiry times.
• Where it is held. An append-only store operated by Echo Prime Tech LLC on infrastructure it controls. Records are added, never edited in place; a correction is a new record, so the chain stays auditable.
• Who can read it. Verdict verification is public and unauthenticated by design — anyone holding a verification id can confirm a seal at /verify without an account. The underlying evidence artifacts are tenant-scoped and require authentication.
• Signing key separation. Verdicts are signed by a key held out-of-process from the control plane, so compromising the application does not by itself let an attacker mint a valid seal.
• Tamper evidence. The signature binds the verdict to the exact evidence chain that produced it. A modified payload fails verification rather than verifying against a different record.
• Retention and deletion. Retention windows and deletion rights are set out in the data retention policy. Evidence under an active legal hold is exempt from routine deletion until the hold is released.

• Security headers (CSP, HSTS, frame denial, nosniff) on this site
• Certification Forge: signed verdicts, hash-chained evidence, public verify
• Default-blocked promotion until evaluation gates pass (fail-closed)
• Policy surface: Acceptable Use, Privacy, DPA

Suspected account takeover or billing fraud: contact [email protected] immediately and CC [email protected].