Our security posture, compliance status, data handling practices, and the sub-processors we engage — all in one place. We believe transparency is foundational to the trust you place in Phalanxia.
We are actively building the compliance infrastructure required to serve regulated enterprise customers.
Our SOC 2 Type II audit is currently in progress. We are working with an accredited third-party auditor to evaluate controls across the Security, Availability, and Confidentiality trust service criteria. We do not claim SOC 2 certification at this time.
Phalanxia operates as a data processor for customer telemetry and as a data controller for account and billing data. We maintain a data processing agreement (DPA) available to all customers. Our privacy practices are described in our Privacy Policy.
All data in transit is encrypted using TLS 1.2 or higher. Connections using older protocol versions are rejected. HTTP requests are redirected to HTTPS.
Customer data stored on Phalanxia infrastructure is encrypted at rest using AES-256. Database and object storage volumes use provider-managed keys with customer-managed key options available on enterprise plans.
Access to customer data is governed by role-based access control with least-privilege defaults. All internal access to production systems is logged, reviewed periodically, and requires multi-factor authentication.
Production infrastructure is monitored continuously for anomalous activity. Security-relevant events are logged to an append-only audit trail retained for a minimum of 90 days.
We maintain a vulnerability disclosure policy, conduct periodic penetration testing, and apply security patches on a defined schedule based on severity rating.
We maintain a written incident response plan. In the event of a security incident affecting customer data, we will notify affected customers within the timeframes required by applicable law and contract.
By default, customer data is processed and stored in the United States. We use cloud infrastructure located in US-based availability zones for primary storage and processing workloads.
The following list identifies the third-party sub-processors Phalanxia currently engages to deliver its services. We maintain this list and will notify customers of material changes at least 30 days in advance.
We will notify customers of material changes to our sub-processor list at least 30 days in advance. Customers with DPAs may object to new sub-processors per the terms of their agreement.
Real-time service status, including any active incidents and maintenance windows, is published at our status page. Subscribe to receive notifications for platform events.
Service-level commitments are defined per plan tier in the customer order form and govern the deployed ARES platform environment.
For security vulnerability reports, review our disclosure policy. For general trust and compliance questions, reach our security team directly.
Machine-readable: /.well-known/security.txt