Last updated 2026-05-21 (R174 content) — independent failure domain from api.preferium.com.
Preferium AI Edge — Trust Center
Customer-facing surface that will be served at trust.preferium.com post-deploy. This file is the canonical content source — the Astro static Worker (apps/trust/ — planned R175+) pulls from this and the linked legal/trust documents.
Last updated: 2026-05-21 (R174)
At a glance
| Control | Status |
|---|---|
| GDPR | Compliant — DPA available, sub-processor list public, Art. 30 records maintained |
| Data residency (EU) | Primary data plane (Supabase Postgres) hosted in EU (Frankfurt). Edge cache distributed across 300+ datacenters. |
| Encryption in transit | TLS 1.3 minimum + HSTS preload |
| Encryption at rest | AES-256 (Supabase managed); OAuth tokens AES-GCM-encrypted in worker memory (key never reaches Postgres) |
| MFA for privileged roles | Scaffold shipped R171 (enforcement after staging soak — MFA_ENFORCEMENT_MODE env-flag) |
| SSO/SAML for Enterprise | Scaffold shipped R173 (tenant_sso_configs table + 503 route stubs; samlify wire-up R175+) |
| Tamper-evident audit log | Hash chain shipped R170-R174 (P39) — chain coverage 27/~37 callsites + chain-only DB trigger (warn mode) |
| Penetration testing | First annual engagement scheduled R174 (external firm, $8-15k engagement). Summary published, full report under NDA. |
| SOC 2 Type 2 | In progress — observation window starts R200, audit completion mid-2026 |
| ISO 27001 | Deferred — re-evaluation R200+ based on customer demand |
| CCPA | Reactive — implemented when first California customer signs |
| HIPAA / FedRAMP | Out of scope — Preferium AI Edge is not pursuing healthcare/US government workloads in v1 |
Available artifacts (downloads)
| Artifact | Format | Notes |
|---|---|---|
| Data Processing Agreement (DPA) template | Markdown → PDF on deploy | GDPR Article 28-compliant. Customer fills in name/address/effective date and counter-signs. |
| Privacy Policy | Markdown → HTML | Public-facing privacy policy for Preferium.com properties. |
| Terms of Service | Markdown → HTML | Master service agreement. |
| Vulnerability Disclosure Policy (VDP) | Markdown → HTML | RFC 9116 safe-harbor + scope + SLA. Advertised via /.well-known/security.txt. |
| Sub-processor list | Markdown → HTML | Maintained per GDPR Art. 28(3). 30-day change notice per DPA.md §5. |
| GDPR Article 30 records of processing | Markdown → PDF on deploy | Template applies to Preferium AS as Processor; per-tenant extracts available on request. |
| Software Bill of Materials (SBOM) | CycloneDX JSON | Generated by anchore/sbom-action (syft) + Sigstore-attested on every release tag. Obtain + verify at /sbom/. |
| Artifact attestations | SLSA L3 attestations | Generated via GitHub Actions Attest-Build-Provenance on every release (R166). |
| Penetration test summary | Public summary. Full report under NDA — request via security@preferium.com. First engagement R174. | |
| Status page | external (Better Stack) | 90 days uptime history + RSS subscription + email alerts. |
Security disclosures
- Report vulnerabilities per the VDP at
security@preferium.com(or via/.well-known/security.txtinstructions). - We follow coordinated disclosure with a 90-day default disclosure window (negotiable).
- Safe harbor: good-faith research per VDP §3 is not subject to legal action.
- Bug bounty: planned R175+ via HackerOne.
Sub-processors
Active list maintained at docs/legal/sub-processors.md. Subscribe to trust.preferium.com/changelog (RSS planned R175+) for change notifications.
Current count: 11 active sub-processors across 7 categories (primary infra / LLM providers / Google APIs / billing / email / SEO data / observability).
Compliance certifications
| Framework | Status | Target date | Notes |
|---|---|---|---|
| SOC 2 Type 2 | Not started — preparation R170-R200, audit R200+ | Mid-2026 | Vanta or Drata for evidence automation + external CPA audit. 3-mo preparation + 3-mo observation. |
| ISO 27001 | Deferred — re-evaluation R200+ pending demand | TBD | Most NO/Nordic mid-market accepts SOC 2 alone. Broader ISMS than SOC 2. |
| GDPR | Compliant ✅ | Maintained | DPA + sub-processor list + Art. 30 records + DPO + breach-notification process all in place. |
| CCPA | Reactive — implemented at first California customer | Within 30 days of need | Adds CA-specific disclosures + opt-out flow to Privacy Policy. |
| HIPAA | Out of scope | Never | Not pursuing healthcare. |
| FedRAMP | Out of scope | Never | Not pursuing US federal. |
Data Protection Officer
Per docs/legal/dpo-designation.md, the DPO role is currently held by Robert Andre Johansen (Founder/CEO Preferium AS). Robert is the primary contact for data-subject requests, supervisory authority communications, and Customer DPO-to-DPO escalations.
R174 records the long-term DPO arrangement (Option A: Robert; Option B: external DPO service; Option C: hybrid). Decision documented in docs/legal/dpo-designation.md.
Contact: dpo@preferium.com (alias to current DPO mailbox).
Incident response
- Breach detection: Sentry (R111-R118 multi-layer) + Better Stack uptime alerts + AI Gateway error-rate alerts (R102-R105).
- Notification SLA: GDPR Art. 33 — Supervisory authority (Datatilsynet) within 72 hours. Affected customers concurrently.
- Runbook:
RUNBOOK.md§2 (incident playbooks per failure mode). - DR drill cadence: Quarterly (runbook shipped R171; first execution scheduled 2026-08-21).
- Latest post-mortem: None yet — no incidents to publish.
Changelog
The changelog for trust artifacts (sub-processor changes, certification milestones, audit findings) will be published at trust.preferium.com/changelog post-R175 deploy with RSS subscription.
For now: see the change logs in sub-processors.md §J and gdpr-article-30-records.md §H.
Contact
- Security disclosures:
security@preferium.com(per VDP) - Data Protection Officer:
dpo@preferium.com - DPA & legal:
post@preferium.com - General trust questions:
trust@preferium.com(alias to current responsible party)
Implementation status
R171 originally planned the full trust center deploy. R171-R174 progressed as follows:
- ✅ R157 (2026-05-19): trust architecture ADR + DPA template + VDP policy + sub-processor list (initial) + DPO placeholder
- ✅ R168 (2026-05-19):
.well-known/security.txtserved from edge worker per RFC 9116 - ✅ R174 (2026-05-21): GDPR Art. 30 records template + sub-processor list canonicalization + this trust center index. Doc deliverables complete; Astro Worker deploy + Better Stack setup are operator gestures.
- ⏳ R175+:
apps/trust/Astro package + DNS records + Better Stack workspace + first pen-test engagement signed.