Security

At PolicyCortex, security is not just a feature—it's foundational to everything we build. As an autonomous cloud management platform, we understand that our customers trust us with access to their most critical infrastructure. We take this responsibility seriously.

PolicyCortex is built on enterprise-grade cloud infrastructure with security at every layer:

• Deployed on Azure Government Cloud and AWS GovCloud for compliance-sensitive workloads
• All data encrypted at rest using AES-256 encryption
• All data encrypted in transit using TLS 1.3
• Network segmentation and micro-segmentation for workload isolation
• Regular infrastructure security assessments and penetration testing

We implement strict access controls to protect your data and our systems:

• Zero-trust architecture—never trust, always verify
• Multi-factor authentication (MFA) required for all access
• Role-based access control (RBAC) with least-privilege principles
• Just-in-time (JIT) access for privileged operations
• Comprehensive audit logging of all access and actions

Your data is protected throughout its lifecycle:

• Customer data isolation—your data is never commingled with other customers
• Data residency controls to meet regulatory requirements
• Automated data backup with encrypted storage
• Secure data deletion upon request or contract termination
• No use of customer data for AI model training

PolicyCortex is designed to meet the most stringent compliance requirements:

• SOC 2 Type II compliant architecture
• Built for FedRAMP, HIPAA, and CMMC compliance
• Regular third-party security audits
• Continuous compliance monitoring of our own infrastructure

Security is embedded in our development lifecycle:

• Secure coding practices and regular security training
• Automated security scanning in CI/CD pipelines
• Dependency vulnerability monitoring and patching
• Code review requirements for all changes
• Regular security-focused architecture reviews

We maintain a robust incident response program:

• 24/7 security monitoring and alerting
• Documented incident response procedures
• Regular incident response drills and tabletop exercises
• Customer notification within 72 hours of confirmed breaches
• Post-incident reviews and continuous improvement

We welcome responsible security research. If you discover a security vulnerability in PolicyCortex, please report it to security@policycortex.com. We commit to:

• Acknowledging receipt within 24 hours
• Providing regular updates on remediation progress
• Not pursuing legal action against good-faith researchers
• Recognizing researchers who help improve our security (with permission)