{
  "$comment": "Machine-readable security & compliance posture for OmniForce. Keep in sync with /trust.",
  "organization": "OmniForce",
  "schema": "https://omniforce.run/security.json",
  "contact": {
    "security": "security@omniforce.run",
    "privacy": "privacy@omniforce.run"
  },
  "encryption": {
    "in_transit": "TLS 1.2+",
    "at_rest": "provider-managed (AES-256)",
    "crawler_ips": "keyed HMAC hashes only, never raw"
  },
  "tenant_isolation": {
    "model": "multi-tenant with PostgreSQL row-level security (RLS)",
    "reports": "shareable by unguessable token; aggregate metrics only"
  },
  "access": {
    "sso": ["SAML", "OIDC"],
    "provisioning": "SCIM",
    "roles": ["owner", "admin", "viewer"],
    "audit_log": true,
    "available_on": "scale"
  },
  "compliance": {
    "gdpr": "aligned",
    "dpa": "available on request",
    "sccs": "available",
    "soc2": { "status": "type_1_available; type_2_in_progress" },
    "data_residency": { "eu": "add-on (scale tier)" }
  },
  "reliability": {
    "uptime_sla": "99.9% monthly (enterprise)",
    "status_page": "https://omniforce.run/status"
  },
  "disclosure": {
    "policy": "responsible disclosure",
    "acknowledgement_within_business_days": 2
  },
  "subprocessors": [
    { "name": "Neon", "purpose": "Managed PostgreSQL (primary datastore)", "location": "EU / US" },
    { "name": "Coolify (self-hosted)", "purpose": "Application hosting & deploys (our infrastructure)", "location": "EU" },
    { "name": "Cloudflare", "purpose": "Edge delivery, WAF and DDoS protection", "location": "Global" },
    { "name": "Polar", "purpose": "Merchant of Record — payments & tax", "location": "EU" },
    { "name": "Resend", "purpose": "Transactional email delivery", "location": "US" },
    { "name": "OpenAI / Anthropic / Google / OpenRouter", "purpose": "Answer-engine probing (no customer data used for training)", "location": "US / EU" }
  ]
}