Security and trust
Security at Gammaxon
Your data stays inside the boundary you draw. This page describes how we handle it, how we are audited, and how to reach us if you find a problem.
How we protect your data
Six commitments, in plain terms
Data handling
Your data is processed on infrastructure you control. We do not train models on customer data and we keep no copy after an engagement ends.
- Data never leaves the deployment boundary unless you configure an export
- Retention and deletion schedules set per workspace
- Our engineers reach your environment only through your identity provider, with your approval, in recorded sessions
Air-gapped and on-premises options
The same release runs connected, on-premises, or fully air-gapped.
- No required outbound connection and no telemetry unless you turn it on
- Signed offline installers and update bundles, with checksums you can verify on your own
- Reference hardware and network layouts reviewed with your security team before install
Encryption
Data is encrypted in transit and at rest, and the keys are yours.
- TLS 1.2 or later on every connection, TLS 1.3 preferred
- AES-256 encryption at rest for data, models, and backups
- Customer-held keys through your own KMS or HSM; keys never leave your site
Access control
Least privilege by default, with a record of everything that happens.
- SSO through SAML 2.0 or OpenID Connect, with multi-factor authentication enforced
- Role-based access per workspace; sessions expire after 12 hours of inactivity
- Tamper-evident audit log of sign-ins, data access, and administrative changes, exportable to your SIEM
Secure development
Every release is built, tested, and signed through the same controlled pipeline.
- Peer review required for every change
- Static analysis, dependency, and container image scanning on each build
- Independent penetration test every year; summary available under NDA
- Critical vulnerabilities patched within 7 days and delivered as a signed update
Incident response
A named security engineer is on call at all hours.
- Customers are told about a confirmed incident affecting their environment within 48 hours
- A written post-incident review follows every confirmed incident
- Notification terms are part of your agreement
Compliance
Audited every year, by someone else
Gammaxon holds a SOC 2 Type II report covering the security, availability, and confidentiality criteria, issued after an annual independent audit. Our information security management system is certified to ISO/IEC 27001:2022.
The SOC 2 Type II report, the ISO 27001 certificate, and the latest penetration test summary are available to customers under NDA through the portal.
- SOC 2 Type IIAnnual independent audit
- ISO 27001Certified management system
- Penetration testedIndependent test every year
- Customer-held keysEncryption keys never leave your site
Responsible disclosure
Found a vulnerability? Tell us first
If you believe you have found a security problem in our products or on this site, report it to us before you tell anyone else. We acknowledge every report within two business days and keep you informed until it is resolved.
- Contact
- security@gammaxon.com
- Machine-readable policy
- /.well-known/security.txt
- What we ask
- Give us reasonable time to fix an issue before you disclose it, and do not access, change, or keep data that is not yours.
- What you can expect
- We will not pursue action against researchers who follow this policy in good faith, and we will credit you in our advisory if you wish.