Skip to content
Legal

Security

Last updated: October 2026

This page describes the technical measures we take to secure pegbitstudio.com and the client portal at clients.pegbitstudio.com. It’s a summary of practice, not a compliance certification — see Section 12 of our Privacy Policy for how this fits our broader data handling.

1. Transport and infrastructure

  • HTTPS is enforced site-wide with HSTS (Strict-Transport-Security, including subdomains and preload), so browsers refuse to load the site over plain HTTP once they’ve visited once.
  • A Content Security Policy restricts which scripts, styles, and frames the site can load, reducing the impact of any third-party script compromise.
  • X-Frame-Options: DENY and a frame-ancestors ‘none’ CSP directive prevent the site from being embedded in another site’s frame (clickjacking protection).
  • X-Content-Type-Options: nosniff stops browsers from guessing content types in a way that can be exploited.
  • Hosted on Vercel’s edge infrastructure, which provides DDoS mitigation and automated certificate management at the platform layer.

2. Application security

  • No API keys, tokens, or secrets are ever shipped to the browser — the AI Brief feature calls Anthropic’s API from a server-side route only, with the key held in Vercel environment variables.
  • The AI Brief endpoint is rate-limited per IP address to reduce abuse, and all input is length-capped and validated before use.
  • The client portal uses passwordless, one-time “magic link” sign-in — we never store a password for you, so there is no password database to compromise.
  • Client-role portal accounts can only ever read data linked to their own organisation. That boundary is enforced at the data access layer, not just hidden in the interface.

3. Data protection

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to production systems and data is restricted on a least-privilege basis to the people who need it to deliver the work. See our Privacy Policy for the full list of processors and how long data is retained.

4. Certifications

We do not currently hold SOC 2 or ISO 27001 certification. If your organisation requires a specific compliance attestation as a condition of engagement, tell us during scoping and we’ll confirm honestly whether we can meet it.

5. Reporting a vulnerability

If you believe you’ve found a security issue affecting pegbitstudio.com or the client portal, email info@pegbitstudio.com with details. We don’t currently run a paid bug bounty, but we investigate every report and will credit responsible disclosure on request.

6. PegBit Core & PegBit Witness: security and deployment

PegBit Core (formerly called Omos) is our production layer for enterprise AI, and PegBit Witness is our tamper-evident evidence layer for AI actions. Both are built to one principle: data should never leave the boundary that owns it, and every AI decision must be defensible. Below is what runs today and what is still roadmap — each item is labelled, and you can hold us to those labels.

The three guarantees, in order: your boundary (designed to run inside your own environment); production-grade by default (grounding, citation, audit trails and guardrails are the core, not add-ons); and no vendor hostage (vendor-neutral model routing with failover across providers).

  • Data isolation — Live. Each product’s knowledge lives in its own isolated store. PegBit Core serving one product never sees another product’s data. This is the architecture running beneath Sydence, AI Kraft and ExamSurf today.
  • Model neutrality — Live. Your data never trains shared models. Model providers receive only the minimum context needed to answer a given request.
  • Grounding and citation — Live. Answers come only from the knowledge base of the product being served and are cited to their source. If the knowledge can’t support an answer, PegBit Core says so — it never invents.
  • Tamper-evident action sealing (PegBit Witness) — In build. Every prompt, completion, source citation, and agent action is sealed into a cryptographic SHA-256 hash chain — editing, dropping, or reordering any record breaks the chain, providing auditors and compliance officers with verifiable evidence.
  • Guardrails (the Gatekeeper) — In build. Input sanitisation, prompt-injection defence, PII redaction, and re-validation of any action before it runs.
  • Deployment options — Roadmap. Hosted (an isolated workspace on our infrastructure), Dedicated (single-tenant, with configurable data residency), and In your cloud (deployed inside your own tenancy, so data never leaves your infrastructure).
  • Compliance controls (the Registrar) — Roadmap. Retention windows, legal holds, data-subject requests and audit exports, aligning with the NDPR, the GDPR and the UAE PDPL, with a SOC 2 roadmap. We won’t claim certifications before they exist.

Evaluating PegBit Core or PegBit Witness for procurement? Email info@pegbitstudio.com with “Security review” in the subject, and we’ll walk your security team through the architecture and share the current sub-processor list.

7. Changes to this page

We’ll update this page as our security practices evolve. We’ll update the “Last updated” date above when we do.

Read our Privacy Policy →