How we protect
your data.

All persistent data is encrypted at rest using AES-256. Key management is handled by the infrastructure layer; keys are rotated on a regular schedule and are never stored alongside the data they protect.

All data in transit — between your browser and SICenter's servers, between our services, and between our services and third-party APIs — is encrypted using TLS 1.3. We reject connections that negotiate older protocol versions. Certificate pinning is enforced on server-to-server calls where the endpoint is under our control.

Scan results, findings, and asset metadata are stored in a multi-tenant database. Each row is tagged with an organization ID. Application-level queries include an organization ID predicate on every read and write; the database layer enforces row-level security policies as a second check. A query from one tenant cannot return rows belonging to another.

Every API request — REST and MCP — is authenticated against a bearer token that resolves to a specific organization. The middleware layer extracts the organization ID from the token and attaches it to the request context before any handler executes.

Scope assertions are enforced at the API boundary. Asset lookup, scan dispatch, and finding queries all verify that the requested resource belongs to the authenticated organization. Requests for out-of-scope resources return a 403 rather than a 404 to prevent enumeration.

Background workers — scan runners, discovery jobs, notification dispatchers — receive their organization context from the job payload and validate it before execution. A misconfigured job payload results in a job rejection rather than cross-tenant data access.

Integration credentials (API keys, OAuth tokens, webhook signing secrets) are stored in encrypted columns. The encryption key is separate from the database encryption key and is stored in a secrets manager with access logging and key-rotation support.

MCP tokens are displayed to the user exactly once at creation time and are not stored in recoverable form thereafter. The stored value is a salted hash used only for validation. If a token is lost, it must be revoked and a new one issued.

Environment variables containing sensitive configuration are never logged. Log scrubbing middleware strips any string matching common secret patterns (API key formats, JWTs, bearer tokens) from log output before it is written to the log aggregator.

Every privileged action — authentication events, API key creation and revocation, scan dispatch, finding status changes, integration configuration — is written to an append-only audit log. The log records the actor identity, the action, the affected resource, a timestamp, and the source IP.

Audit log records are retained for the duration set by your plan tier. Enterprise plans retain logs for one year. The audit log is exported via the REST API and can be streamed to a SIEM of your choice using the signed webhook integration.

Log entries are immutable after write. The infrastructure does not provide a delete endpoint for audit records; retention-based deletion is automated and cannot be triggered by application-layer API calls.

We welcome responsible disclosure of security vulnerabilities affecting SICenter. If you discover an issue, please email security@sicenter.io. We will acknowledge your report within two business days and provide a timeline for remediation.

We ask that you do not disclose the vulnerability publicly until we have had a reasonable opportunity to remediate it. We commit to resolving critical issues within 30 days and providing you with credit in our disclosure notice if you wish.

Out-of-scope items include denial-of-service attacks, social engineering, attacks against physical infrastructure, and findings from automated scanners submitted without manual verification.

We map our day-to-day engineering controls to the AICPA SOC 2 Trust Service Criteria so security buyers can evaluate fit before a long questionnaire round-trip. SICenter has not yet completed a Type II audit; this matrix describes the controls we operate continuously.

Need a security questionnaire response or vendor risk assessment? Email security@sicenter.io and we'll respond within one business day.