Legal
Security policy
Last updated: September 21, 2026
1. Security model
This Security Policy describes how Apocalypse Technologies (“we”, “us”), which owns and operates Actrone, secures the platform. Security is built into the shape of the Actrone platform, not applied as an afterthought. Key design decisions include: API keys are SHA-256 hashed before storage, so raw keys are never persisted; JWTs are RS256-signed with a JWKS endpoint for key rotation; the Violation Ledger is Merkle-chained and append-only; tool calls pass through an 8-step validation pipeline before execution; SSRF protection operates on an allowlist, not a blocklist.
2. Infrastructure security
The hosted platform runs on AWS in VPC-isolated environments. All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Network access is controlled by security groups with least-privilege rules. Database credentials are managed via AWS Secrets Manager with automatic rotation. No credentials are stored in source control (enforced by pre-commit hooks).
3. Application security
All dependencies are pinned and scanned for vulnerabilities on every CI run (govulncheck, pip-audit, npm audit). No high or critical vulnerabilities are permitted in production. Input validation occurs at every service boundary using allowlist patterns. SQL injection is prevented by parameterised queries only, with no string interpolation in database calls. XSS is prevented by React’s default escaping and a strict Content-Security-Policy header.
4. Responsible disclosure
We take security reports seriously and commit to the following: acknowledge receipt within 24 hours; provide an initial assessment within 72 hours; keep you informed of remediation progress; credit you in the changelog if you wish (and disclose is not sensitive). Please do not publicly disclose the vulnerability until we have released a fix and notified affected users.
5. Reporting a vulnerability
To report a security vulnerability, email security@actrone.com with: a description of the vulnerability; steps to reproduce; potential impact assessment; any proof-of-concept code (please do not use it to access real user data). We do not currently operate a bug bounty programme, but we acknowledge all valid reports and aim to remediate critical findings within 48 hours, high within 7 days, and medium within 30 days.
6. Security compliance
Apocalypse Technologies is pursuing SOC 2 Type II certification. Current controls include: access log retention for 12 months; change management with PR-based review and CI gates; annual penetration testing by an independent third party; vulnerability management with defined SLAs; employee security training. Enterprise customers may request a copy of the current controls summary.
7. Incident response
In the event of a confirmed security incident affecting customer data: we will notify affected customers within 72 hours (GDPR-required); we will provide details of what data was affected, how, and what we are doing; we will engage external forensics if the incident warrants it; we will publish a public incident report (excluding sensitive details) within 30 days of resolution.