Organization. What is the legal name of the company?
Services AttestLayer, operating as AttestLayer. Quebec enterprise number 2282022963. Head office: 360 Saint-Jacques Street, Suite G101, Montreal, Quebec H2Y 1P5, Canada. Source: /company.
AttestLayer security questionnaire
This is our own questionnaire, answered the way we answer yours. Where the honest answer is no, or not yet published, it says so.
A signed client package of this questionnaire is not issued on this page. The answers below cite the public page or say that the fact is not published. Download the same text from the procurement information ZIP.
Organization. Who operates the service?
Rabie-Abdollah Macbahi is the founder and operator, and the privacy officer. Source: /company and /privacy.
Hosting. Where are customer questionnaires and records processed?
Files are stored and processed in Google Cloud in Montréal (northamerica-northeast1). For the AI step, only the relevant excerpts and the question text are sent to Anthropic’s Claude API, which processes them in the United States. Source: /product-security and /privacy.
Hosting. Does an AI model read customer records?
Yes, for one narrow step. To check each question, we send only the relevant excerpts of your records and the question text, never whole files, to Anthropic’s Claude API. An AI model (Claude, by Anthropic) only selects sentences that already exist in your records; every answer is a word-for-word quote checked by fixed rules and a second AI check, and nothing reaches your client until you approve it. Parsing, source linking, signing and verification run in AttestLayer’s own Google Cloud project. Source: /privacy, /faq and /subprocessors.
Assurance. Do you have SOC 2?
No. Neither Type I nor Type II. Source: /product-security.
Assurance. Do you have ISO/IEC 27001?
No. Source: /product-security.
Assurance. Do you have an independent penetration test?
No. Source: /product-security.
Assurance. Do you hold cyber or errors-and-omissions insurance?
No. None held as of 30 September 2026. Source: /product-security.
Access. How does a customer sign in?
Email link, single use, expires after 15 minutes. The session ends after 30 minutes idle or 12 hours, whichever comes first. A hash of the link and of the session secret is stored, not the link itself. Source: Client Console sign-in code and /signin.
Access. How is AttestLayer administrator access protected?
Not published here. Email security@attestlayer.com.
Encryption. How is data protected in transit and at rest?
HTTPS in transit. Google-managed encryption for supported storage and databases at rest. Source: /product-security.
Encryption. Where does the package signing key live, and what is the rotation policy?
Not published beyond the issuer keys listed for verification. Email security@attestlayer.com.
Privacy. Who owns the records and the answers?
The customer owns the records and the answers. They are not reused for another customer. Working copies are deleted after 14 days. Source: /product-security and /data-retention.
Privacy. How soon is a confirmed breach of customer personal data reported?
Within 72 hours after confirmation. Source: /dpa.
Subprocessors. Which providers process customer data?
Google Cloud (Montréal) for the application and records. Anthropic (United States) for AI inference on excerpts of records and the question text. Stripe for card and invoice data. SendGrid (United States) for email delivery. PostHog only if the visitor consents to optional analytics. Cloudflare Turnstile on disclosed public forms. Source: /subprocessors.
Development. Are customer files used to train a model?
No. Under Anthropic’s commercial terms, excerpts sent to the Claude API are not used to train models without permission (we have not given it) and are deleted from Anthropic’s systems within 30 days, unless a usage-policy review requires longer retention. Source: /privacy, /faq and /product-security.
Availability. Is there an uptime SLA?
No. Buyer Review Pack is a one-time service. Source: /status.
Vulnerability management. How do I report a vulnerability?
security@attestlayer.com, and the vulnerability disclosure policy. A security.txt file is published. Source: /vulnerability-disclosure.
Public site. Does the public site load third-party scripts?
No. The public site loads no third-party scripts. Source: /product-security.
Continuity. What are the backup frequency, retention, last restore test, RPO and RTO?
Not published. Email security@attestlayer.com.
Logging. What customer-file access is logged, and for how long?
Not published as a customer-file access log. Email security@attestlayer.com.
Incidents. What security incidents have you had?
No incident history is published on the status page yet. Source: /status.