# Security and compliance

## Certifications and frameworks

| Item | Status | How to obtain evidence |
|---|---|---|
| SOC 2 Type II | maintained, audited annually | report available under NDA via `sales@scispace.com` |
| GDPR | DPA available on request | `sales@scispace.com` |
| ISO 27001 | in progress | — |
| HIPAA | **not supported** | do not send PHI |
| PCI DSS | not applicable — we never receive card data through the API | — |

## Transport and storage

- TLS 1.2 or later required for all API traffic; HTTP requests are rejected, not redirected
- AES-256 at rest for documents, parsed text, and generated answers
- Encryption keys managed in AWS KMS with annual rotation

## Access control

Access is governed by API key scopes and organization roles — see teams-and-scopes. Internal
access to customer content is role-restricted, logged, and reviewed quarterly.

## Isolation

Documents are scoped to the organization that uploaded them. There is no cross-organization retrieval
path: a Chat can only reference documents its own organization owns.

## Reporting a vulnerability

Email `security@scispace.com`. We acknowledge within 24 hours and work to a 90-day coordinated
disclosure. Please do not test against other organizations' data or run load-generating scans against
production — use a test key and tell us first.

## Changes to this policy

Certification changes are reflected here within 30 days and noted in the changelog.

## Related

data-privacy · teams-and-scopes · reliability · authentication