Security & trust
We sell decision-grade truth, so this page follows the same rule as our analysis: every claim below maps to a specific piece of code or configuration we can show under NDA — and what we cannot prove yet, we say plainly in the last section instead of claiming it.
What we do — verifiable in the code
Append-only audit log
Every client-facing action is written to an audit log that the database itself refuses to rewrite: UPDATE and DELETE are blocked by database triggers, not by application code. What was said, and when, cannot be silently edited afterwards — not even by us.
Passwords
Passwords are stored as bcrypt hashes (cost 12) — never in plain text, never recoverable. An Argon2id migration path (OWASP’s current recommendation) is prepared in the codebase: existing hashes are re-minted on login once it is switched on.
Sessions & tokens
Session tokens are JWTs with algorithm pinning (HS256 only — the alg-confusion attack class is excluded by construction) and required claims: a token without an expiry, issue time or subject is rejected. API tokens are stored only as SHA-256 hashes; if the database ever leaked, the tokens in it would be unusable. Revocation is soft, so the audit trail survives it.
Encrypted backups
Database backups are encrypted with AES-256 (key derived via PBKDF2) in a stream — the dump never touches disk unencrypted — and every backup must pass an immediate decryption-and-integrity test with the same key before it is accepted; a backup that cannot be restored is discarded, and a missing encryption key stops the backup with an error rather than falling back to plain text. Rolling retention of the last 14 verified backups. Code history is preserved separately as integrity-verified git bundles.
Transport security
TLS on all public hostnames, with certificates issued and auto-renewed via Let’s Encrypt. Secrets live outside the code; inputs are validated; CORS is strict.
Deployment model
We onboard customers on single-tenant deployments: one database per customer, so your data is separated by infrastructure, not by a WHERE clause. Hardened multi-tenant isolation on shared infrastructure is on our roadmap — and until it ships, we do not claim it.
Compliance by design
Copyright-safe
We do not republish third-party content: we keep metadata, numbers, canonical links. For paid sources we show our own short, transformative summary, with a similarity filter and a disclaimer.
GDPR
Record of processing activities, legal basis, DPIA for thematic profiling; data export and deletion on request (privacy@antesigna.com, response within 30 days). No surveillance of natural persons.
No financial advice
Theme-only analysis: no personalized recommendation on instruments, no handling of any individual’s portfolio. Automatic disclaimers on every financial output.
Ethics & dual-use
Hard filters block targeting/surveillance of individuals, military use cases and personalized advice. Actor models cover only states and public roles.
Provability
Every output carries its evidence chain — sources traced back to the original, confidence class and factual anchor. The numbers are computed by code; the LLM writes only the prose, with grounding and an honest refusal when the evidence is not enough.
What we do not claim yet
A trust page that only lists strengths is marketing. This one is an inventory.
No SOC 2 / ISO 27001 certification yet
Formal certification is on the roadmap. Until an independent auditor has signed, we will not put a badge on this page.
No contractual SLA yet
We run the platform continuously and monitor it, but we have not yet committed to a contractual uptime figure — so we do not advertise one.
Single-region hosting
The platform runs in a single EU region (Hetzner). No multi-region failover yet.
No multi-tenant isolation claim
Shared-infrastructure tenant isolation is not something we claim today; that is exactly why customers get single-tenant deployments instead.
Questions, or an item you need for procurement? Write to support@antesigna.com — if we do it, we will show you where in the code; if we do not, we will tell you when.