Tech Ringer AI

Security Posture

What we do, how we do it, and what we don't claim yet. Updated as the platform evolves — last reviewed: May 2026.

What We Have In Place

Encryption at rest

All tenant secrets and OAuth tokens encrypted with AES-256-GCM. Versioned key rotation via primary/secondary key IDs.

Credential isolation

OAuth tokens never enter the LLM context. A dedicated tool executor injects credentials server-side at the moment of tool invocation. The agent never sees a secret.

Service-to-service auth

Every internal worker-to-worker request signed with HMAC-SHA256 over `{timestamp}:{method}:{pathname}:{body}` using a rotated shared key. Timing-safe verification.

Audit logs

Every tool call, every guardrail event, every safety scan logged with tenant and user attribution. Retained for the lifetime of the account; exportable on request.

Auth & rate limiting

JWT validation cached in KV with SHA-256 hashed keys (60s TTL). API keys hashed at rest. Per-tenant rate limiting via KV sliding window.

Transport

TLS 1.2+ enforced. HSTS with includeSubDomains. Strict CSP (frame-ancestors none, base-uri self). All cookies SameSite=Strict where possible.

The AI Safety Pipeline

Two pipelines run on every agent interaction. They're the part of the product we're most willing to explain in public.

Input guardrails

  1. Heuristic filter (fast, ~10ms)
  2. LLM guardrail + URL safety chain in parallel (200–500ms)
  3. Decision: block, rewrite, or pass

URL safety chain: Google Web Risk → Cloudflare URL Scanner → LLM fallback. Fail-open if all providers unavailable.

Tool-result safety

  1. Security scan (malware, injection in returned content)
  2. PII scan — redact with placeholders (`[EMAIL]`, `[SSN]`, …)
  3. Verification — does the result match the requested action?

PII always redacts (never blocks). Security threats hard-block. Verification surfaces mismatches to the audit log.

See the safety stack in detail

Compliance — What We Claim and What We Don't

We don't claim certifications we don't have. Here's the honest status:

  • SOC 2 Type II: in progress. Roadmap target — see changelog for updates.
  • GDPR / CCPA: data export and deletion supported via support request. Self-serve export coming.
  • HIPAA: not currently supported. Do not store PHI on Tech Ringer AI.
  • Penetration testing: internal red-team exercises ongoing. External pentest scheduled.

If you need a specific compliance posture for a procurement process, contact us directly — we'd rather have an honest conversation than check a box we don't deserve to check.

Vulnerability Disclosure

If you've found a security issue, we want to know. We commit to:

  • Acknowledge your report within 2 business days.
  • Investigate and provide a status update within 7 business days.
  • Coordinate public disclosure with you, on a reasonable timeline.
  • Not pursue legal action against good-faith research.
security@techringer.ai

Encrypted communication encouraged. PGP key publication is on the roadmap.

Want to go deeper?

AI Safety Stack Privacy PolicyStatus