Trust & Compliance.

Effective July 1, 2026

Developum AI Inc. operates the EVOLUM platform against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. This page describes exactly what that means, what we can prove, and what a prospective auditor or enterprise buyer can request from us on any given day.

Honest framing. We are SOC-2 compliant — our controls, policies, and evidence align with the SOC-2 Type II framework. We do not hold a signed attestation report from a CPA firm at this time; that engagement is available when a customer or investor requires it. Our full auditor package — 8 policies, system evidence, and automated control scripts — is ready to share.

What We Have Today

Eight Corporate Security Policies

Access Control Policy — Authentication standards, Supabase JWT lifecycle, SSH key handling, Row-Level Security tables, and 1-hour token rotation.
Change Management Policy — Development lifecycle, local WSL testing, Git versioning, pull-request approvals, systemd rollback procedures.
Incident Response Plan — Detection, containment, eradication, and voice/webhook-based critical alert dispatch.
Master Information Security Policy — Workstation disk encryption, 10-minute auto-lock, general security posture, employee expectations.
Disaster Recovery & Business Continuity Plan — Node recovery checklists, backup validation, Hetzner data-center failure RTO/RPO metrics.
Risk Assessment and Registry — Threat classification, impact ratings, control mitigations index.
Employee Onboarding / Offboarding Checklists — Background checks, NDA compliance, 24-hour access revocation.
Vendor Management Policy — Annual review criteria and security assessment protocols for Supabase, Stripe, Hetzner, and other sub-processors.

System Evidence & Automation

SOC-2 Compliance Audit Log — Live telemetry scanner report demonstrating clean checks across the Trust Services Criteria we're scoped for.
Incident Alerter — Active handler catching framework alerts and dispatching notifications.
RLS Audit Script — Weekly cron-scheduled validator confirming Postgres row-level security is intact.
Backup Verifier — Daily cron-scheduled audit of SQL dump availability in backup storage.

Trust Services Criteria — Where We Stand

Criterion	Posture
Security	Encryption in transit (TLS 1.2+) and at rest (Supabase-managed AES-256). Least-privilege access enforced via Supabase RLS. Workstation encryption and auto-lock enforced.
Availability	Hetzner primary infrastructure. Daily automated database backups. Documented DR/BCP with RTO/RPO targets. Uptime monitoring on customer-facing endpoints.
Confidentiality	Screenplay and personal data never leaves the platform for third-party AI processing. Deterministic engine runs locally. Zero customer content transmitted to external LLM APIs.
Processing Integrity	Deterministic Python + JSON pipeline. Same input → same output. Auditable transformation logs.
Privacy	Covered under our Privacy Policy and Data Processing Addendum. GDPR- and CCPA-aware data handling.

How to Get the Auditor Package

Enterprise buyers, investors performing security diligence, and prospective auditors can request the full readiness package by writing to security@developumaiengine.com. We reply within two business days and share the package under mutual NDA.

The package includes: all 8 policy documents in full, system evidence exports, automation script source, our sub-processor list with security-review dates, and current risk register.

The Road Ahead

A formal SOC-2 Type II attestation engagement will be initiated when a customer, investor, or partner requires the signed report — or when we choose to pursue it proactively as we scale. When that happens, this page will be updated with the auditor, engagement dates, and eventually the signed report itself.

Until then: we are compliant, we are ready, and we can prove it on any given day.

Questions or requests? Reach us at security@developumaiengine.com for security, compliance, or auditor inquiries. For all other legal questions: hello@developumaiengine.com.