Security

This page is maintained by BondGovernance to summarise the security posture of the BondGovernance governance-infrastructure service for professional counterparties, prospective customers and security researchers.

This page describes app-visible controls and provider-attested platform capabilities. It is not a certification and is not an independent assurance report.

• Frontend: TanStack Start on Cloudflare Workers (EU edge), TLS 1.2+ enforced.
• Backend: Supabase Postgres + Auth + Storage, hosted in the EU (Frankfurt).
• Deterministic compute: pure functions in TypeScript, no model-derived business decisions persisted without provenance.
• Document extraction: EU AI gateway → Gemini, EU region, no training on customer data.
• Segregated production and preview environments.

• Encryption in transit (TLS 1.2+) and at rest (AES-256 managed by provider).
• Row-Level Security on all tenant-scoped tables.
• Least-privilege service-role access; service-role key never exposed to the client bundle.
• Authentication via Supabase Auth; MFA available; SAML SSO available on request.
• Append-only audit log for authentication events, role changes and privileged actions.
• Daily encrypted backups; documented restore procedure; point-in-time recovery.
• Dependency vulnerability scanning on every release.
• Security review checklist on each pull request touching auth or data access.

The BondGovernance service is engineered for a 99.99% availability design target for the audit-trail and governance-rule subsystems, with automated failover and encrypted daily backups.

Customer records, governance decisions and audit logs are retained for 10 years by default. This retention period aligns with the record-keeping obligations set out in MiFID II Art. 16(6) and national extensions used by supervisory authorities when reviewing investment-firm books and records.

These are engineering and policy targets, not contractual SLAs or independent assurance commitments. Specific SLA terms are negotiated under NDA.

BondGovernance commissions independent penetration tests of the public web application and backend API on a recurring basis. The programme covers the OWASP ASVS L2 control set, authentication and session management, tenant isolation, server-function authorisation, and common web application weaknesses (OWASP Top 10).

A redacted summary letter of the most recent independent test is available to qualifying counterparties under NDA on request to security@bondgovernance.com.

We welcome reports from independent security researchers. Please disclose suspected vulnerabilities to security@bondgovernance.com with sufficient detail to reproduce.

• We acknowledge receipt within 2 business days.
• We provide a triage outcome within 10 business days.
• We aim to remediate critical issues within 30 days.
• We will credit researchers on request once a fix is deployed.

Please do not access data that is not your own, do not run denial-of-service tests, and do not test third-party providers in our supply chain.

We operate a documented incident-response plan with a named owner. Confirmed personal-data breaches are notified to affected controllers without undue delay and within 72 hours, in line with the obligations set out in our Data Processing Agreement.

Security: security@bondgovernance.com. Data protection: dpo@bondgovernance.com.