Our Security Practices

This page is about how Phaethon Security operates as a company: how we protect the data you give us through this website, how we run our own systems, and how we build and ship our software. We hold ourselves to the same NIST SP 800-171 practices we help our customers meet.

It is not a description of how Attestor or Ordinance work. Those products are self-hosted — they run inside your network, and we never receive your data from them. For product security, see Attestor and Ordinance.

Our Security Posture

Phaethon Security's security practices broadly align with NIST SP 800-171. All Phaethon Security administrators are required to authenticate with phishing-resistant, time-based one-time password (TOTP) multi-factor authentication before accessing production systems or customer data. Customer accounts can enable TOTP MFA on their own profile at any time. Customer data is hosted within the continental United States and is encrypted in transit and at rest using modern, non-deprecated cryptographic protocols.

We regularly evaluate the security practices of our critical vendors in accordance with our Third Party Risk Management policy.

While we have not yet attained our AICPA SOC 2 Type II attestation, we plan to do so by H1 2027. In the meantime, enterprise clients may request to evaluate our security practices by contacting info@phaethonsecurity.com.

Access & Authentication

Email/password and Google OAuth sign-in for customer accounts.
Time-based one-time password (TOTP) multi-factor authentication is required for all Phaethon Security administrators.
Role-based access control separates administrator, provider, and user permissions; roles are stored server-side and enforced by database policies.
Anonymous sign-ups are disabled.

Platform & Hosting

The Phaethon Security web application is built on React and Tailwind and deployed to a managed hosting platform fronted by HTTPS/TLS.
Backend services — database, authentication, edge functions, and storage — are operated on a managed cloud backend with encryption in transit and at rest.
Production secrets are managed through the platform's secret store; application code does not embed service-role credentials.
This page describes app-visible controls operated by Phaethon Security and is not an independent certification of the underlying platform.

Data Collection & Use — this website

Everything in this section is about this website and your Phaethon Security account. The products are different: Attestor and Ordinance are self-hosted, and we receive no data from them at all. If you download and run a product, none of the collection described here applies to it.
We collect account information you provide (name, email, company), content you submit (listings, inquiries, compliance tracking), and standard application/usage telemetry.
Customer data is used to deliver the services you request and to communicate with you about your account.
Phaethon Security does not sell, rent, or trade personal data. See our Privacy Policy for full detail.

Data Protection

Row-level security policies restrict each database table so users can only access their own records, with security-definer views used to expose public profile data without leaking PII or internal notes.
Sensitive data is transmitted over TLS and stored on encrypted managed infrastructure.
Administrative access to production systems is limited to named personnel using MFA.

Subprocessors & Integrations — this website

These subprocessors serve this website and your Phaethon Security account. They are not in the path of any self-hosted Attestor or Ordinance deployment.
Managed cloud backend (database, authentication, storage, edge functions).
Stripe — payment processing for marketplace listings and product purchases.
Resend — transactional and notification email delivery from info@phaethonsecurity.com.
Lovable AI gateway — model inference for AI-assisted features such as listing screening and content generation.
Hostinger — DNS and domain hosting for phaethonsecurity.com.

Personnel Security & Training

Phaethon Security staff complete regular security awareness and role-based training, including secure development, data handling, and incident response.
Our team maintains recognized information security certifications, including the ISC2 Certified Information Systems Security Professional (CISSP).
Administrative access is limited to trained, named personnel and is reviewed periodically.

Cookies, Analytics & Privacy Requests

We display a GDPR-style cookie consent banner and only set non-essential cookies after consent.
You may request access to, correction of, or deletion of personal data we hold about you by contacting us.
We respond to verified privacy requests within a reasonable timeframe consistent with applicable law.

Incident Response & Vulnerability Reporting

Phaethon Security maintains an internal incident response process and will notify affected customers of confirmed incidents that materially impact their data.
Suspected security vulnerabilities can be reported to info@phaethonsecurity.com. Please include reproduction steps and avoid testing against other customers' data.
We appreciate responsible disclosure and will acknowledge valid reports.

Compliance & Shared Responsibility

Phaethon Security helps customers prepare for frameworks including NIST 800-53, NIST 800-171, CMMC, SOC 2, HIPAA, and ISO 27001 through our advisory services and compliance hub.
Materials and tooling provided through this site are advisory; they do not constitute audit, certification, or legal opinions.
Security is a shared responsibility: Phaethon Security operates the platform and its controls described above, while customers remain responsible for how they use the service, manage their own accounts, and handle data they upload or share.

Secure development & release

Verify us before you trust us.

Don't take our word for it — verify it. Security buyers are paid to distrust vendors; here are the tools to check how we build and ship software.

Every image is cryptographically signed.

We sign with Sigstore cosign, keyless — the signature is bound to the exact GitHub Actions workflow and git commit that built the image, not to a key someone holds. There is no signing key to steal.

Verify before you run it.

You can verify our signature yourself, in your own environment, before pulling anything into an enclave.

Every image ships an SBOM.

A full software bill of materials and build-provenance attestation is attached to each image — the artifact your supply-chain reviewer asks for.

Pinned by digest, not by tag.

Our install bundles pin exact image digests, so the build you assessed is provably the build you are running months later.

Third-party licences included.

Each image carries a NOTICE file listing every open-source component and its licence, generated at build time from the actual installed dependency tree.

Try the verification yourself:

cosign verify ghcr.io/chrismagill/ordinance@sha256:<digest> \
  --certificate-identity-regexp '^https://github.com/chrismagill/ordinance/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Replace <digest> with the image digest from the bundle's release notes.

Security Contact

Security and privacy questions, vendor questionnaires, and vulnerability reports can be sent to info@phaethonsecurity.com.

Last updated: June 25, 2026. Phaethon Security may update this page as our controls and subprocessors evolve.