# Trust center (public-facing outline)

**Status:** Phase 5 trust-center page content (TDD-444)  
**Non-claim:** this page summarizes **readiness mapping and engineering
controls**. It does **not** claim SOC 2, ISO 27001, FedRAMP, or DORA
certification until an accredited issuer says so.

## Product security posture (engineering)

- Sensor **zero-egress** default; Ops plane optional sinks
- Containment / kill-switch independence
- Agentic authority matrix (SEC-AG-001…004)
- Supply-chain baseline (pinned Actions, govulncheck, SBOM, cosign, VEX)

## Documents

| Topic | Link |
|-------|------|
| Tenant isolation | [tenant-data-isolation.md](../architecture/tenant-data-isolation.md) |
| DPA / Bonterms draft | [bonterms-dpa-draft.md](bonterms-dpa-draft.md) |
| SOC2 / ISO / FedRAMP readiness mapping | [soc2-iso-fedramp-readiness.md](soc2-iso-fedramp-readiness.md) |
| OpenSSF Scorecard track | [openssf-scorecard-track.md](openssf-scorecard-track.md) |
| ASR/VRM kit | [asr-vrm/README.md](asr-vrm/README.md) |
| AI risk governance | [ai-risk-governance/README.md](ai-risk-governance/README.md) |
| Privacy pack | [../compliance/privacy-pack.md](../compliance/privacy-pack.md) |

## Contact

Security disclosures: follow repository `SECURITY.md` (if present) or maintainer
contacts in [maintainers.md](maintainers.md).