Trust
Trust Center
How Armorer protects your code, your agents and your data, where our SOC 2 examination stands, and how to get what your security review needs.
Compliance.
We publish what is in place today and say plainly what is not finished yet.
SOC 2
In progress
Our examination with an independent auditor is under way. We do not hold a SOC 2 report yet.
Security package
Available under NDA
Our system description, security policies and Incident Response Plan, sent under a mutual NDA.
Vulnerability disclosure
Published
Our disclosure policy and the RFC 9116 security.txt file tell researchers how to reach us.
Security controls.
A summary of the controls we run today. The full descriptions and the evidence behind them are in our security package.
20 controls in 6 areas
Infrastructure
Where the service runs and how it is built.
4 controls4 controls
- Our hosted service runs on AWS in the United States.
- Production runs in its own AWS account, apart from staging, sandbox and this website.
- Production infrastructure is defined in code.
- Production tables have point-in-time recovery and deletion protection.
Data protection
How we protect customer data and code.
4 controls4 controls
- Customer data is encrypted in transit and at rest, and our hosted service requires TLS 1.2 or higher.
- Production data uses customer-managed encryption keys.
- We use customer source code only to deliver the service, never to train, fine-tune or evaluate a model.
- In your environment, Armorer's runtime protection sends no customer content to Armorer by default.
Identity and access
Who can reach our systems, and how.
3 controls3 controls
- Staff access to AWS goes through single sign-on with our identity provider.
- Multi-factor authentication is enforced on our identity provider and across our GitHub organization.
- When someone leaves, we remove their access to core systems within 24 hours.
Secure development
How changes reach production.
3 controls3 controls
- Changes to production code go through pull requests on protected branches, with automated checks that include AI code review.
- Code scanning, secret scanning with push protection, and dependency security updates run on production repositories.
- Automated deployments use short-lived roles through OpenID Connect.
Monitoring and response
How we detect and respond to security events.
3 controls3 controls
- An organization-wide AWS audit trail goes to a separate archive account under write-once retention.
- Threat detection runs across our AWS organization.
- We keep a documented incident response plan and test it with a tabletop exercise every year.
Organizational security
Our people, devices and vendors.
3 controls3 controls
- Everyone at Armorer signs confidentiality and invention assignment agreements and acknowledges our Code of Conduct.
- Company laptops use full-disk encryption.
- Our vendor policy requires SOC 2, ISO 27001 or equivalent assurance from critical vendors.
Subprocessors.
We use service providers in these categories:
- Cloud infrastructure and hosting
- Authentication
- Source-control platform
- AI model providers
- Company email and identity
- Email delivery
We name the providers that process your data before any processing starts.
Where your agreement provides for it, we give at least 30 days' email notice before a new subprocessor begins processing your data.
Request our security package
This page is the summary. Under a mutual NDA we send our security package:
- System descriptionUnder NDA
- Security policiesUnder NDA
- Incident Response PlanUnder NDA
- Business Continuity and Disaster Recovery PlanUnder NDA
We answer security questionnaires the same way.
Opens an email to security@armorerlabs.com.
Reporting a vulnerability
If you believe you have found a vulnerability in any Armorer system, software or repository, email security@armorerlabs.com.
Our disclosure policy sets out the rules of engagement, and our machine-readable contact is published at /.well-known/security.txt.
Data questions.
Does our source code leave our environment?
An assessment needs the agent's source or a runnable copy. How that access works, and where the isolated copy runs, are agreed in writing before any access is granted. We name the providers that process your data before any processing starts.
Do you make a zero-retention claim?
No. We do not make a zero-retention claim today. We name the providers that process your data before any processing starts.
Do you have a SOC 2 report?
Not yet. Our SOC 2 examination is in progress, and Armorer does not hold a SOC 2 report yet. We work under a mutual NDA and answer security questionnaires in writing.
This page is a summary, and nothing on it is a certification of the service.
Security questions go to security@armorerlabs.com.