Trust center
Security at Actuarium
How Actuarium protects your data: row-level access control, encrypted transport and storage, hashed API keys, governed model deployment, immutable audit trail, and controls mapped to the SOC 2 Trust Services Criteria.
The live trust center — enabled for this project and carrying platform attestations, infrastructure evidence and machine-readable control data — is served on the published site at /.well-known/trust.html (JSON).
Every table — saved analyses, exam attempts, study plans, API keys, cohorts — enforces row-level security in the database. A user can only read what they own, what has been shared with them as a reviewer, or what a cohort manager is entitled to. There is no application-level bypass in browser code.
TLS 1.2+ on every connection; data encrypted at rest by the managed cloud database provider. Secrets (AI gateway, search, scheduler token) live only in the server runtime and never reach the browser.
Public API keys are generated with 192 bits of entropy and stored as SHA-256 hashes; the plaintext is shown once. Keys are scoped to the issuing user's data and can be revoked instantly.
Saved analyses carry status (draft → in review → approved → locked), immutable version snapshots, reviewer sign-off with comments and an append-only audit log. The rating API deploys only approved or locked models.
Service-role access is used only inside server functions after verifying the caller, for tasks such as the daily knowledge scan and API-key resolution. It is never used for ordinary reads or to decide who is an administrator.
Hosting, database and edge runtime run on providers holding SOC 2 Type II and ISO 27001 attestations. The published trust center (linked below) carries the platform-level evidence.
Controls mapped to the SOC 2 Trust Services Criteria
Each Actuarium control below is mapped to the AICPA TSC criterion it implements. This is a self-assessment of the application layer; the infrastructure layer is covered by the provider attestations in the live trust center.
| Criterion | Area | Actuarium controls |
|---|---|---|
| CC6.1 | Logical access | Row-level security on every table; per-user API keys scoped to owned data; authenticated server functions verify the caller before any privileged action. |
| CC6.6 | Boundary protection | Public API surface is limited to /api/public/*; all other server functions require a bearer token. Webhook-style endpoints verify shared secrets before processing. |
| CC6.7 | Transmission & storage | TLS 1.2+ in transit; encryption at rest via the managed database provider; secrets confined to the server runtime. |
| CC6.8 | Unauthorized software | Locked dependency manifest; automated dependency vulnerability scanning on every change; findings tracked to resolution. |
| CC7.1 | Monitoring | Database linter and security scanner run continuously; configuration warnings (RLS, grants, function search paths) are surfaced and tracked. |
| CC7.2 | Change management | Model and rate deployments require draft → review → approval; only approved/locked versions are quotable; every transition is written to an append-only audit log with actor and timestamp. |
| CC8.1 | Change authorization | Rating deployments are versioned, signed by the deployer, and immutable once locked; vendor targets receive only approved artifacts. |
| A1.2 | Availability | Serverless edge runtime with automatic restart and scaling; managed database with provider backups and point-in-time recovery. |
| C1.1 | Confidentiality | Uploaded CSVs are processed in the browser; only saved coefficients persist. Deletions cascade to versions, approvals and audit rows the owner controls. |
Subprocessors
| Provider layer | Purpose | Attestation / safeguard |
|---|---|---|
| Cloud hosting & edge runtime | Application hosting, SSR, server functions | SOC 2 Type II, ISO 27001 |
| Managed database & auth | PostgreSQL database, authentication, row-level security | SOC 2 Type II, ISO 27001 |
| AI gateway | Tutoring, question generation, narration (prompt content only) | Provider-attested; no training on submitted prompts |
| Search & syllabus fetch | Course Scout video search and official syllabus retrieval | API key held server-side only |
Vulnerability disclosure
Found a security issue? Report it through the project workspace's security channel. We ask that you give us reasonable time to remediate before public disclosure, do not access data that is not yours, and do not degrade service for other users. Verified reports are triaged against the same controls above and tracked to resolution.
SOC 2 — honest status
Actuarium runs on infrastructure holding SOC 2 Type II and ISO 27001 attestations, and its application controls are mapped to the Trust Services Criteria above with continuous scanning. Actuarium itself has not yet completed an independent SOC 2 Type II audit of its own organization; commissioning one is on the roadmap as usage grows. We keep this stated plainly on the benchmark page.
Data handling
- Uploaded CSVs in GLM Studio are processed in the browser; only the fitted coefficients you choose to save are stored.
- AI requests carry only the prompt content you submit; no exam attempt history is sent unless you include it.
- Delete any saved analysis, key, cohort or question at any time; deletions cascade to versions, approvals and audit rows you own.