Where we are on the trust roadmap.
Our security posture, compliance roadmap, data handling, and incident response.
What we do today.
Security posture
VPC-first deployment, customer-managed signing keys (ECDSA P-256), fail-closed behavior, mTLS at the edge. Full details on the Security page.
Standards engagement
Formal submission to NIST on AI agent security (Docket NIST-2025-0035, February 2026). Read the comment.
What's planned.
SOC 2 Type II
Scoping underway.
Penetration testing
Third-party penetration testing will be scheduled as design partner engagements begin. Results will be available to partners under NDA.
Third-party security audit
Independent security audit will be conducted as part of the SOC 2 preparation process.
How data flows.
Subprocessors
No subprocessors. Panopticore runs in the customer's VPC. Agent traffic, policy decisions, and Evidence Binders remain in the customer's environment.
Data residency
Panopticore deploys in your VPC, so data stays wherever your infrastructure is.
Data retention
You control retention for event data and Evidence Binders. Panopticore imposes no retention limits of its own.
If something goes wrong.
- Acknowledgment: Security reports acknowledged within 2 business days
- Customer notification: Affected customers notified within 72 hours of confirmed security incident
- Disclosure: Public disclosure after remediation, coordinated with affected parties
Diligence questions?
Send them to our security team and we'll answer directly.