AI points to your own sentences. It never writes answers.
Exact quotes are checked by code, fixed rules, and a second model before you approve them.
Trust center
Everything a security or procurement reviewer needs, in one place. Nothing here is claimed that you can't check.
Files stored in Canada, working copy deleted after 14 days
Relevant excerpts are processed by Anthropic in the United States for up to 30 days.
Every package verifiable offline, forever
The published key checks the files without an account.
What you can verify today
| Control | Status | Verify it |
|---|---|---|
| Administrator accounts protected by hardware security keys | In place | Security page |
| Operator actions require a passkey and an allowlisted network | In place | Security page |
| Customer sign-in: single-use link, 15-minute expiry; sessions 30 min idle / 12 h | In place | Security page |
| Order database encrypted with a customer-managed key (Cloud KMS) | In place | Security page |
| Daily backups with point-in-time recovery; 30 retained; last restore test: 3 October 2026 | In place | Security page |
| Security logs kept 90 days; access to customer files logged | In place | Security page |
| Public site loads no third-party scripts; strict CSP, HSTS preload | In place | View headers |
| SPF, DKIM, DMARC on attestlayer.com | In place | DNS |
| 72-hour breach notification | Contractual | DPA §9 |
| Sub-processors published, change notice before processing | In place | Subprocessors |
| Vulnerability disclosure policy and security.txt | In place | security.txt |
| No security incident affecting customer data as of 2026-10-01 | Statement | Security page |
| Package signing keys in Secret Manager; public keys published with validity dates | In place | Registry |
Documents
Our completed security questionnaire
The SBQ-60, answered about AttestLayer, as a verifiable package.
ATTESTLAYER-SBQ60-2026-10-02
Trust Pack
Before you upload: the Trust Pack (ZIP, no email needed)
2026-10-02
Data Processing Addendum
Countersigned PDF on request.
Version 2026-10-05
Security and data handling
Storage, access, and deletion.
Version 2026-10-05
Subprocessors
Who processes data, and where.
Version 2026-10-10
Retention and deletion
How long each category of record is kept.
Version 2026-10-08
Privacy notice
What personal information the service uses.
Version 2026-10-10
Terms
The contract for a paid order.
Version 2026-10-10
Accessibility statement
WCAG 2.2 AA target and known limits.
Version 2026-09-30.1
What we don't have yet, and what we do instead
| Not held | What exists instead |
|---|---|
| SOC 2 Type I / Type II | The controls above are published and checkable. Our own questionnaire is answered and signed. The first 10 packages are checked by the founder before release. |
| ISO/IEC 27001 | Same. |
| Independent penetration test | A vulnerability disclosure policy and security.txt. The public site loads no third-party code. |
| Cyber and E&O insurance | A liability limit in the Terms and a fix-within-3-business-days-or-refund policy. |
We list what's missing so you don't have to ask. Dates are added here the day any of it changes.
Verify a package
Verification proves the files are unaltered since issue and were signed by our published key. It does not prove the answers are true, and it is not a certification or an audit opinion; your organization decides that.
Talk to us
security@attestlayer.com · privacy@attestlayer.com
We reply within 1 business day. A countersigned DPA is available on request.