SECURITY OVERVIEW

Security and data handling

This page describes the current assisted pilot. It is a factual product overview, not a certification or contractual security schedule.

Data submitted

An exact-version evaluation sends the package ecosystem, package name and exact version. Source code and repository contents are not required for this operation. Package coordinates may reveal internal technology choices and should be treated according to the customer’s classification rules.

External evidence providers

ossfind retrieves public package metadata from the relevant npm, PyPI or Maven metadata provider and vulnerability information from OSV. These suppliers receive package coordinates. Supplier availability and published data affect results.

Access and audit controls

• Service credentials are stored as cryptographic hashes.
• Evaluator, auditor and administrator roles separate evaluation from history and administration.
• Completed decisions retain the actor, evidence timestamps, policy identifier and policy fingerprint.
• Evaluation requests are bounded by global concurrency, request quotas and per-principal quotas.

Availability and evidence freshness

Supplier responses use bounded timeouts, duplicate-request suppression, short-lived caching and reactive cooldowns. Expired evidence is not used as a fallback approval when refresh fails. The pilot currently runs as one instance and does not include an uptime SLA.

Optional AI review

Gemini review briefs are disabled by default and run only after a user requests an explanation for a recorded review or deny decision. The server sends a minimized evidence projection to Google with interaction storage disabled; it does not send source code, credentials or the audit actor. Strict response validation, evidence-reference checks, per-principal quotas and caching limit this surface. AI output is advisory and cannot change a policy decision. Customers should use a paid Gemini project and review Google’s processing terms and DPA before enablement.

Current assurance status

The service has undergone automated tests and focused live acceptance checks. It is not currently certified under SOC 2, ISO 27001 or another independent assurance framework. Penetration testing and a customer-specific data-processing agreement are not included by default.

Report a vulnerability

Send a concise report to pamynllp@pamyn.in. Include affected behavior, reproduction steps and impact. Do not include credentials or customer data in the initial message.

Last updated: September 13, 2026.