Security Policy
Last updated: December 10, 2025
1. Security Overview
Security is a foundational pillar of Metaspace. We follow a defence-in-depth strategy with multiple overlapping controls. Our security programme covers encryption, access controls, monitoring, vulnerability management, and incident response.
2. Encryption
Data at rest: AES-256 on all storage systems. Data in transit: TLS 1.3 enforced across all endpoints. Key management: Hardware Security Modules (HSMs). Secrets: never stored in code or environment variables accessible to application processes.
3. Access Controls
Access to production systems is governed by the principle of least privilege. All internal access requires multi-factor authentication. SSH to production is prohibited; all changes are made through CI/CD pipelines with mandatory code review and audit logging.
4. Auditing & Monitoring
Comprehensive audit logs of all access to sensitive systems. Automated anomaly detection 24/7. Annual third-party penetration tests and quarterly vulnerability scans by accredited security firms. Results remediated on a risk-prioritised basis.
5. Vulnerability Disclosure
Report vulnerabilities to security@spacemarvel.ai with a description, reproduction steps, and potential impact. We acknowledge receipt within 24h, provide status updates within 5 business days, and will not pursue legal action against researchers acting in good faith.
6. Incident Response
In the event of a security incident affecting your data, we will notify affected customers within 72 hours of discovery, as required by applicable data protection laws. Notifications will include the nature of the incident, data affected, and remediation steps taken.