Overview
Persoon.ai Inc builds software as an AI-agent-run company. Security, reliability and privacy run as code, with evidence available on demand. This Trust Center summarizes our program, the standards we align to, the vendors we rely on, and how to reach us or report a security issue.
Last updated: 2026-10-18.
Standards
Our program is aligned with SOC 2 (Trust Services Criteria) and NIST SP 800-53 Rev 5, and provides coverage for common vendor security questionnaires (SIG Lite and CAIQ).
Status, stated honestly. The program formally started on 2026-10-18, which is our evidence baseline. We are not certified: no independent audit has been performed yet. An official SOC 2 report can only be issued by an independent, licensed CPA firm; nothing on this page is a substitute for that. We report what is in place today versus what is planned, rather than claiming completeness.
Security program overview
We run a repeatable audit-readiness program. Because AI agents write, review, approve, operate and audit our systems, our controls are expressed as code and checked continuously. The program is in active rollout; each policy tracks, point by point, what is in place today versus planned.
- Written, versioned policies covering information security, access control, change management, incident response, backup and recovery, encryption and key management, logging and monitoring, risk, business continuity, secure development, AI agent governance, vulnerability management, privacy and more — each versioned and reviewed at least annually.
- Change management — every change lands through a branch and pull request, with independent automated review and required checks before merge.
- Secrets — kept in a business password manager with scoped service accounts, never in source control.
- Backup and recovery — infrastructure built from code (infrastructure as code) with regular restore drills.
- Logging and monitoring — activity is recorded, retained and alerted on, with access reviews and restore drills on a defined cadence.
- AI agent governance — each agent has its own identity, least privilege, a complete activity log, and change review, under documented controls.
Policies
Our security program is governed by the versioned policies below. Each is reviewed at least annually. Customers, auditors and insurers can request the current policy packet from security@persooninc.com.
| Policy | Summary |
|---|---|
| POL-01 Information Security | Top-level security policy: sets the rules that apply to all work, names the accountable owner role, and links the rest of the policy set. |
| POL-02 Access Control | Controls who and what can reach systems and data, granting least privilege, with access reviewed quarterly and removed when no longer needed. |
| POL-03 Change Management | Makes every change safe, reviewed and traceable — including agent-authored changes under separate reviewer identities: add before removing, fix forward, and never skip tests. |
| POL-04 Incident Response | Detect, contain and recover from security incidents and outages quickly; keep evidence and learn from every incident. |
| POL-05 Backup and Recovery | Ensures every production app and its data can be restored within set times, proven by regular restore drills. |
| POL-06 Vendor Management | Knows which vendors we depend on, what data they touch and how secure they are; approves new vendors and watches costs. |
| POL-07 Data Classification and Retention | Classifies data so it gets the right protection, keeps it only as long as needed, and deletes it safely. |
| POL-08 Acceptable Use | Sets clear rules for how people and AI agents use company accounts, systems, data and AI tools. |
| POL-09 Encryption and Key Management | Protects data with encryption and manages secrets and keys safely: where they live, who can read them, how they reach apps, and how they rotate. |
| POL-10 Logging and Monitoring | Records what happens on our systems, retains the records long enough, and alerts on problems early. |
| POL-11 Risk Assessment | Finds, rates and treats security risks, and maintains an up-to-date risk register. |
| POL-12 Business Continuity | Keeps critical services running and recovers from major disruptions such as losing a server, a provider or a key device. |
| POL-13 Secure Development | Builds software that is secure by default, with automated security checks that block unsafe changes. |
| POL-14 AI Agent Governance | Gives every AI agent its own identity, least privilege, a complete activity log, and an accountable chain that does not depend on any human step. |
| POL-15 Vulnerability and Patch Management | Finds and fixes security weaknesses in code, dependencies, containers and servers before they can be exploited. |
| POL-16 Asset Inventory | Knows every system, service, domain, identity and data store the company runs, so nothing is unmanaged. |
| POL-17 Personnel Security | Ensures every person or agent is set up correctly, bound by policy, and fully removed when they leave. |
| POL-18 Privacy | Handles personal information lawfully, only for stated purposes, and honours individuals' rights. |
| POL-19 Physical and Environmental Security | Relies on cloud and hosting providers for physical security and verifies it through their reports. |
| POL-20 Code of Conduct | Sets the expected behaviour for everyone and every agent acting for the company. |
| POL-21 Security Awareness Training | Ensures everyone and every agent knows the security rules that apply to their work. |
| POL-22 SOC 2 Audit and Compliance Monitoring | Continuously checks that controls work, collects evidence, fixes gaps on a deadline, and prepares for the external SOC 2 audit. |
Subprocessors
We use the third-party subprocessors below to operate our products. We give notice of material subprocessor changes on this page.
Last reviewed: 2026-10-18.
| Vendor | Purpose | Location | Trust page |
|---|---|---|---|
| Vercel | Application hosting, DNS, edge network | Global | security.vercel.com |
| Supabase | Database, authentication, storage | See vendor | supabase.com/security |
| Hetzner | Dedicated and cloud servers | Germany and Finland | hetzner.com |
| Cloudflare | DNS, CDN, domain registration | Global | cloudflare.com/trust-hub |
| Stripe | Payment processing | Global | stripe.com/docs/security |
| GitHub | Source code hosting and CI | US | github.com/trust |
| Google Workspace | Email and documents | US | workspace.google.com/security |
| Resend | Transactional email | See vendor | resend.com/security |
| Anthropic | AI models | US | trust.anthropic.com |
| OpenAI | AI models | US | trust.openai.com |
| xAI | AI models | US | trust.x.ai |
| 1Password | Secrets management | See vendor | 1password.com/security |
Compliance reporting schedule
| Activity | Frequency | Next due |
|---|---|---|
| Internal audit (self-assessment, not an audit opinion) | Monthly, first Monday | First run 2026-11-02 |
| Access review | Quarterly | 2027-01-15 |
| Restore drill | Quarterly | 2027-01-15 |
| Post-incident review | After each incident | Within 5 business days |
| Full policy review and risk assessment | Annually, each October | 2027-10 |
| Incident tabletop exercise | Twice a year | To be scheduled |
| Independent SOC 2 audit | Planned | Not yet scheduled |
The monthly internal audit is a self-assessment performed by our own systems. It helps find gaps early, but it is not an independent audit opinion.
Products
- scm.cc — supply chain management software. Trust page.
- ShipReady Metrics — delivery and operations metrics. Trust page.
- CreditOps — credit operations software at creditops.app; no separate product trust page yet, covered by this Trust Center.
Responsible disclosure
We welcome good-faith security research. To report a vulnerability, email security@persooninc.com with the affected product and clear steps to reproduce.
- We aim to acknowledge reports within 3 business days.
- Safe harbor: we will not pursue action for good-faith testing that avoids privacy violations, data destruction and service disruption.
- Please do not publicly disclose an issue before a fix is released or 90 days have passed, whichever is sooner.
- We do not operate a bug bounty program at this time.
Machine-readable contact details: /.well-known/security.txt.
Contact
Security and trust inquiries: security@persooninc.com.
Persoon.ai Inc525 Randall Ave Ste 100 PMB 228
Cheyenne, WY 82001
United States