Preferium AI Edge — Trust

Last updated 2026-05-21 (R174 content) — independent failure domain from api.preferium.com.

Preferium AI Edge — Trust Center

Customer-facing trust surface, served live at https://trust.preferium.com. This file is the canonical content source — the Astro static Worker (apps/trust/) imports it directly and runs as an independent failure domain with no Supabase, KV or AI Gateway binding.

Last updated: 2026-08-13

At a glance

Control Status
GDPR Compliant — DPA available, sub-processor list public, Art. 30 records maintained
Data residency (EU) Primary data plane (Supabase Postgres) hosted in EU (Frankfurt). Edge cache distributed across 300+ datacenters.
Encryption in transit TLS 1.3 minimum + HSTS preload
Encryption at rest AES-256 (Supabase managed); OAuth tokens AES-GCM-encrypted in worker memory (key never reaches Postgres)
MFA for privileged roles Scaffold shipped R171 (enforcement after staging soak — MFA_ENFORCEMENT_MODE env-flag)
SSO/SAML for Enterprise Live. SAML 2.0 SP-initiated + IdP-metadata, InResponseTo-binding, Enterprise-plan-gated (apps/api/src/routes/sso/)
Tamper-evident audit log Hash chain shipped R170-R174 (P39) — chain coverage 27/~37 callsites + chain-only DB trigger (warn mode)
Penetration testing Not yet performed. The first annual engagement (external firm) is in vendor selection; no summary exists yet. We will publish a summary here when the engagement completes.
SOC 2 Type 2 Not started. Evidence automation is not yet contracted and no observation window has begun. A target date will be published here when the engagement is signed.
ISO 27001 Deferred — re-evaluation R200+ based on customer demand
CCPA Reactive — implemented when first California customer signs
HIPAA / FedRAMP Out of scope — Preferium AI Edge is not pursuing healthcare/US government workloads in v1

Available artifacts (downloads)

Artifact Format Notes
Data Processing Agreement (DPA) Markdown → PDF on deploy GDPR Article 28-compliant. Accepted by subscribing; a counter-signed copy is available on request.
Privacy Policy Markdown → HTML Public-facing privacy policy for Preferium.com properties.
Terms of Service Markdown → HTML The whole agreement, for every plan including Enterprise. There is no separate master services agreement.
Vulnerability Disclosure Policy (VDP) Markdown → HTML RFC 9116 safe-harbor + scope + SLA. Advertised via /.well-known/security.txt.
Sub-processor list Markdown → HTML Maintained per GDPR Art. 28(3). 30-day change notice per DPA.md §5.
GDPR Article 30 records of processing Markdown → PDF on deploy Template applies to Preferium AS as Processor; per-tenant extracts available on request.
Software Bill of Materials (SBOM) CycloneDX JSON Generated by anchore/sbom-action (syft) + Sigstore-attested on every release tag. Obtain + verify at /sbom/.
Artifact attestations SLSA L3 attestations Generated via GitHub Actions Attest-Build-Provenance on every release (R166).
Penetration test summary PDF Public summary. Full report under NDA — request via security@preferium.com. First engagement R174.
Status page external (Better Stack) 90 days uptime history + RSS subscription + email alerts.

Security disclosures

Sub-processors

Active list maintained at docs/legal/sub-processors.md. Subscribe to trust.preferium.com/changelog (RSS planned R175+) for change notifications.

Current count: 11 active sub-processors across 7 categories (primary infra / LLM providers / Google APIs / billing / email / SEO data / observability).

Compliance certifications

Framework Status Target date Notes
SOC 2 Type 2 Not started — preparation R170-R200, audit R200+ Mid-2026 Vanta or Drata for evidence automation + external CPA audit. 3-mo preparation + 3-mo observation.
ISO 27001 Deferred — re-evaluation R200+ pending demand No date set Most NO/Nordic mid-market accepts SOC 2 alone. Broader ISMS than SOC 2.
GDPR Compliant ✅ Maintained DPA + sub-processor list + Art. 30 records + DPO + breach-notification process all in place.
CCPA Reactive — implemented at first California customer Within 30 days of need Adds CA-specific disclosures + opt-out flow to Privacy Policy.
HIPAA Out of scope Never Not pursuing healthcare.
FedRAMP Out of scope Never Not pursuing US federal.

Data Protection Officer

Per docs/legal/dpo-designation.md, the DPO role is currently held by Robert Andre Johansen (Founder/CEO Preferium AS). Robert is the primary contact for data-subject requests, supervisory authority communications, and Customer DPO-to-DPO escalations.

R174 records the long-term DPO arrangement (Option A: Robert; Option B: external DPO service; Option C: hybrid). Decision documented in docs/legal/dpo-designation.md.

Contact: dpo@preferium.com (alias to current DPO mailbox).

Incident response

Changelog

The changelog for trust artifacts (sub-processor changes, certification milestones, audit findings) will be published at trust.preferium.com/changelog post-R175 deploy with RSS subscription.

For now: see the change logs in sub-processors.md §J and gdpr-article-30-records.md §H.

Contact

Implementation status

R171 originally planned the full trust center deploy. R171-R174 progressed as follows: