PSIRT as a Service: the whole vulnerability lifecycle, run on the regulatory clock.
This page says what we protect, how, and where we are today. It marks what is built, what is live, and what is still planned, so you can check us rather than take our word.
Pre-production. REMEDiS PSIRT is in active development. No production customer data exists in any environment. Our preview and test environments hold synthetic data only. Every status on this page describes the platform as it is today.
Compliance
Independent certification
None yet. A third party has not audited REMEDiS Security. When one does, we will publish its scope and date here.
We do not publish architecture diagrams, configuration, internal component names, key-management details or the addresses of test environments. That detail helps an attacker more than it helps a customer. Customers and auditors can ask for it under NDA.
The statuses below are maintained by our engineering team and reviewed with each release. Our plan is to generate them from automated checks, so that a status cannot drift from what the system does.
Controls
Last reviewed 15 October 2026
In place working and verified today Built implemented and tested, not yet in use with customer data Planned designed, not built
Data protection
Built Report text and evidence files are encrypted at rest with a separate key for each customer.
Built Each customer's data is isolated from every other customer's, and isolation is covered by automated tests.
Built Uploaded files are treated as hostile: screened on arrival, stored as inert data, never opened or displayed inline.
In place No customer data is sent to any AI service. Any future use will require each customer's explicit consent.
Access
Built Staff sign in with passkeys, which resist phishing. No shared passwords in the product.
Built Actions that cannot be undone need a fresh confirmation.
Built Automated assistants can suggest. They cannot close, reject or publish anything.
Planned No standing staff access to customer content. Support access will be time-limited and visible to the customer.
In place The preview environment is gated by a shared password for invited reviewers, and holds synthetic data only.
Integrity and audit
Built Every change is recorded in a tamper-evident log that can be verified offline.
Planned Log checkpoints published to a location outside our hosting account, so the record survives the loss of that account.
Secure development
In place Memory-safe language for security-critical code.
In place Every change is checked automatically before it merges: formatting, static analysis, tests, dependency and secret scanning.
In place Security-sensitive components get an additional review by a second, separate reviewer.
Built Release builds are reproducible, and their fingerprints are recorded so a build can be checked independently.
Planned Independent third-party penetration test before the first customer. Reviews so far are internal and AI-assisted.
Operations
In place Preview and test releases roll out continuously after passing every check. Production releases will be promoted by a person.
In place Public status page, checked every five minutes.
Planned Written incident-response and breach-notification procedures before the first customer.
Planned Backup and recovery procedures, tested, before the first customer.
Privacy
In place We collect only what the service needs.
Planned Retention of case and audit records defaults to seven years (ten for customers under the CRA), configurable by contract, with erasure on exit.
Subprocessors
Companies that would process customer data on our behalf. No production customer data exists today.
Cloudflare, Inc.Hosting and deliveryUnited States
Hosts and delivers the service and stores service data. Today this covers synthetic data only.
Our development tools, including AI-assisted ones, work on source code and synthetic test data. They never receive customer data or secrets. We will list any new subprocessor here before it handles customer data.
Updates
Trust center and status page published
This page and a public status page are live. Statuses are hand-maintained for now.
Security reviews of core components
The report-intake, evidence-handling and sign-in components each went through rounds of internal, AI-assisted security review, and the findings were fixed and re-checked. They are built and tested but not yet in use with customer data.
Preview environment
A preview environment with synthetic data is available to invited reviewers.
Report a vulnerability
If you found a security problem in REMEDiS Security, email security@remedissecurity.com. Our security.txt has the current contact details. Please give us a reasonable time to fix a problem before you publish it, and do not access data that is not yours.
We acknowledge reports and will publish our response targets before we take on customers.