Trust Center
Security & Compliance
Pretense is built security-first. Here's the evidence.
Compliance Status
Last updated: April 2026. Status reflects current posture; certifications in progress are backed by third-party auditors.
Our controls framework is complete. Formal audit engagement begins Q3 2026 with Drata as our compliance platform.
PHI never processed by Pretense. Mutation happens before any external transmission — your clinical identifiers never leave your network.
No EU personal data stored on Pretense infrastructure. Local-first architecture means data stays within your jurisdiction.
Security policy mapped to ISO 27001:2022 control domains. Formal certification roadmap follows SOC 2 Type II.
Planned for government customers requiring FedRAMP authorization. Architecture review underway to scope control gaps.
No consumer PII collected or sold. Pretense does not build user profiles, run analytics on code content, or monetize data.
Why Local-First Is More Secure
Cloud-based DLP solutions proxy your code through vendor infrastructure. Pretense does not. The mutation engine runs on your machine or within your network perimeter.
// Data flow — your identifiers never leave your machine
Your actual identifiers never leave your machine. Pretense infrastructure is not in the data path.
Identifiers are replaced before any bytes leave your machine. The AI provider receives only opaque tokens.
Pretense infrastructure never stores code, prompts, or mutation maps. Nothing persists outside your environment.
The same input always produces the same mutation. Round-trip restoration is byte-perfect and verifiable.
Every scan, mutation, and reversal is logged to a local tamper-evident SQLite store with cryptographic timestamps.
Zero usage analytics, no crash reporting, no call-home. The proxy is air-gap compatible by design.
Penetration Test Summary
Self-assessment conducted March 2026. External third-party pentest scheduled Q3 2026 concurrent with SOC 2 audit.
| Test Area | Status | Finding |
|---|---|---|
| Proxy HTTP injection | Pass | No vulnerabilities found |
| Secret pattern bypass | Pass | All 30+ patterns covered |
| Mutation reversal | Pass | 100% round-trip verified |
| Rate limiting | Pass | Sliding window effective |
| CSP headers | Pass | Grade A on securityheaders.com |
Compliance Downloads
Documents available immediately. No form required for overview documents. DPA requests can also be sent to legal@pretense.ai.
Responsible Disclosure
Found a vulnerability? We pay bounties.
PGP Key
Email security@pretense.ai to request our PGP public key for encrypted disclosure.
Response SLA
- Critical: 24 hours
- High: 72 hours
- Medium/Low: 72 hours
Enterprise Security Review
Enterprise customers can request a signed DPA, security questionnaire responses (CAIQ, SIG Lite, custom), architecture review calls with our security team, and early access to the SOC 2 Type II report upon completion.