Security is part of the product, not a checkbox. Below is a plain-language summary of our current posture. For a detailed security questionnaire or NDA-gated documentation, contact us using the link below.
An auditable governance layer
Black Ice contains no model. The governance layer performs no inference: answers are lookups against stored, versioned records of human decisions. An AI-powered governance layer cannot be audited in any meaningful sense — a deterministic record can.
- Deterministic by design. The same query returns the same answer, every time — no sampling, no drift between runs.
- Every change carries an actor, a timestamp, and the prior value, so any decision can be replayed from the record.
- No customer content is used to train models, by us or by any sub-processor. This is contractual, not just a policy statement.
- Auditors can export the full record in machine-readable formats (JSON, CSV, RDF/OWL, JSON-LD) and verify it independently.
AI-directing, not AI-powered: our customers point their models at Black Ice, and the models read the record before they write.
Sub-processorsData Processing Agreement
Encryption
- TLS 1.2+ for all data in transit; HSTS enforced on every domain.
- AES-256 encryption at rest for database storage and file storage.
- Signing secrets are SHA-256 hashed client-side before reaching our servers.
Isolation
- Strict workspace tenancy enforced at the database row level (RLS).
- Platform admins are scoped via a separate audit-logged role.
- Edge functions verify JWT and rate-limit by user where applicable.
Operations
- Daily encrypted backups with point-in-time recovery (7-day window).
- Production access is restricted to named engineers with hardware MFA.
- All admin actions are logged to an immutable audit trail.
Incident response
We operate a documented Incident Response Plan with defined severity levels, containment-first procedures, and a blameless post-incident review for every serious event.
- A named Incident Commander owns every incident end-to-end: declaration, decisions, timeline, and communication.
- Affected customers are notified by direct email without undue delay; personal-data breaches are reported to the lead supervisory authority within 72 hours under GDPR Article 33.
- The plan is exercised annually with tabletop scenarios and corrected after every real incident.
Business continuity & disaster recovery
A written runbook defines recovery targets and per-scenario playbooks for database loss, hosting outages, and sub-processor failures.
- Recovery point objective: 24 hours maximum data loss, reduced to minutes for database content via point-in-time recovery.
- Recovery time objective: 24 hours. Application code, migrations, and edge functions redeploy from the version-controlled repository.
- Backup restore drills run annually and after major schema migrations; results are recorded.
Vendor risk management
Every sub-processor is assessed before onboarding and re-assessed annually against five criteria: certifications, data scope, residency, contractual protection, and blast radius.
- A maintained register records each vendor's assurance (SOC 2 Type II, ISO 27001, PCI DSS Level 1 as applicable), data scope, and risk tier.
- No vendor is engaged without a DPA, verified certifications, and a documented minimal data scope.
- We subscribe to security bulletins for all critical vendors; a vendor breach triggers an exposure assessment within 5 business days.
See the full list on our Sub-processors page.
Policy review cycle
All security policies follow a fixed annual review cycle — batched each August — in addition to event-driven reviews after serious incidents, new sub-processors, or material architecture changes.
- Every review updates the document's header date and is recorded in our repository history, so review cadence is independently verifiable.
- The cycle covers the Incident Response Plan, DR runbook, vendor register, privacy policy, terms, DPA, and our access-control and rate-limiting posture.
Security maturity (SAMM)
We self-assess our software security maturity against the OWASP Software Assurance Maturity Model (SAMM) v2 — a lifecycle-wide model that scores how mature our practices are, not just which risks are covered.
- A full self-assessment scores all five business functions and fifteen security practices on a 0–3 maturity scale, with evidence cited to real artifacts.
- Current average maturity is approximately 1.8 out of 3, strongest in build security and operations, with a prioritised roadmap to raise the lowest practices.
- The 12-month improvement roadmap targets a contractor onboarding checklist, per-feature threat modeling, abuse-case testing, quarterly security KPIs, and the first independent penetration test (target Q1 2027).
- The assessment is refreshed annually each August alongside the rest of the security policy review cycle.
Compliance status
- GDPR-aligned today. A countersigned DPA including the EU Standard Contractual Clauses (2021/914, Module Two) is available on request for any paid workspace.
- Data residency: all customer ontology content is stored at rest in the EU (eu-central-1).
- SOC 2 Type II: not certified. No audit is currently engaged and we have not committed to a date. We will publish the timeline here once one is set.
- ISO 27001: not held.
- Independent penetration test: none conducted to date. A summary attestation will be published here once one is completed.
- Responsible disclosure: email security@black-ice.ai.
We would rather state this plainly than imply certifications we do not hold. If your procurement process requires a completed security questionnaire or a written commitment on a specific control, contact us and we will respond in writing.