Everything you need to evaluate Claudit's security posture and data handling — all public, no NDA, no demo request.
Honest statuses — not marketing claims.
SOC 2 Type 2
Audit in preparation — target Q4 2026
GDPR compliance
EU data protection obligations met; DPA available on request
CCPA compliance
California Consumer Privacy Act requirements met
Penetration test
External pentest scheduled; results summary will be published here
Bug bounty programme
Responsible disclosure active at /security; formal bounty programme planned
ISO 42001 (AI management)
Under evaluation for 2026
Encryption in transit
TLS 1.3 on all connections. HSTS enforced with 2-year max-age.
Encryption at rest
Database encrypted at rest with daily automated backups.
Content Security Policy
Per-request CSP nonces eliminate unsafe-inline. strict-dynamic propagates trust.
Authentication
Passwords hashed with bcrypt. TOTP-based 2FA available for all accounts.
Session management
HttpOnly, Secure, SameSite=Lax session cookies. 30-day idle expiry.
Rate limiting
Per-IP and per-user rate limits on all API endpoints. Audit endpoints have additional token-budget limits.
Input isolation
User-submitted code is wrapped in XML delimiters and trust-boundary instructions before LLM processing. Prompt injection is treated as a security boundary.
Dependency scanning
Automated CVE scanning on every build. Critical vulnerabilities block deploys.
IP anonymisation
IP addresses are anonymised before logging. Raw IPs are never persisted.
No third-party tracking
No analytics trackers, ad pixels, or third-party scripts loaded on any page.
Application hosting
Railway (United States)
Database
Supabase — EU (Frankfurt, Germany)
LLM provider
Anthropic Claude API (United States)
US-based processors operate under EU Standard Contractual Clauses (SCCs) for GDPR compliance.
Found a vulnerability? See our Security & Disclosure Policy for scope, response timelines, and how to report. We respond to all valid reports within 5 business days.
Questions about security or compliance?
Contact security@claudit.consulting — no sales call, no NDA required to ask questions.