Security posture, data handling, and procurement documents.
The questions every enterprise security review asks. Published so the back-and-forth happens once, not every quarter.
Compliance posture
THEFT Studio runs research-led enterprise engagements. We are aligned with industry frameworks. We run the controls, we do not currently carry the formal audit certifications. We are explicit about this so your security team knows what they're buying.
Operational controls
Access
MFA on every surface. Least-privilege by default. Hardware key required for production systems. Access reviewed at every phase boundary.
Encryption
AES-256 at rest on all managed storage. TLS 1.3 enforced in transit. Client secrets held in named secret managers (1Password, AWS Secrets Manager, Doppler), never in code or chat.
Data residency
Work happens inside your infrastructure by default. No shadow data copy on our side. When our systems are required, residency is set to your region: US, EU, or other on request.
Audit trail
All access to client systems logged. Logs retained through the engagement plus 90 days post-close. Export available on request before deletion.
Incident reporting
Security incidents reported within 24 hours of detection. Root-cause analysis delivered within 5 business days. Incident response designed with NIST CSF 2.0 in mind.
AI model use
Client data is not used to train, fine-tune, or embed into any model, ours or third-party, without explicit scoped authorization. Provider APIs (Anthropic, OpenAI, Mistral) are configured with zero data retention and training opt-out.
Documents available
Security contact
Security questionnaires, vulnerability reports, or compliance questions go direct.