Pratiques de
Program

Effective Date: May 6, 2026
Last Updated: May 6, 2026

This page describes the security program at Obscurae Intelligence Inc. (“FalsiFind”) for the FalsiFind deepfake detection platform delivered at app.falsifind.com and api.falsifind.com (the “Platform”) and for the marketing website at falsifind.com (the “Website”). It is written for security, risk, and procurement teams at financial institutions, fintechs, and other regulated buyers, and it is structured to map cleanly to standard third-party risk management questionnaires (including SIG Lite, SIG Core, and CAIQ).

We have made specific commitments below. We are happy to discuss any of them in detail under NDA.

Ownership. Security is owned at the executive level. The Chief Executive Officer holds ultimate accountability for the security program. Day-to-day operations are run by an internal security function that reports to the CEO and reviews program status with the Board on a regular cadence.

Policies. We maintain a written information security policy set covering access control, asset management, change management, cryptography, data classification and handling, encryption key management, human resources security, incident response, network security, secure software development, supplier risk, and vulnerability management. Policies are reviewed at least annually and after any material change to the threat environment or the business.

Risk management. We operate a documented risk-management process that identifies, assesses, and treats security and privacy risks on a continuous basis, with formal review at least annually.

Personnel. All personnel undergo background checks where permitted by law, sign confidentiality and IP-assignment agreements before access is granted, complete security awareness training at hire and annually thereafter, and complete role-based training where applicable. Access is removed promptly upon termination.

Hosting. The Platform is hosted on managed cloud infrastructure with major US-based providers identified in our sub-processor list (Section 10), with data residency in the United States by default. The Website is delivered via Vercel.

Cross-domain isolation. Frontend services at app.falsifind.com and backend services at api.falsifind.com run as separate applications with CORS controls and separate deployment surfaces. The marketing site at falsifind.com is fully isolated from the Platform.

Tenant isolation. The Platform is multi-tenant with row-level isolation in PostgreSQL. Tenant identifiers are enforced on every authenticated request, on every database query, and on every storage access path. Tenant-scoped detection policies, geolocation settings, quotas, and subscription tiers are maintained per tenant.

Network. Production environments are protected by managed firewalls, network ACLs, and TLS termination at the edge. Database and cache services are not exposed to the public internet. Administrative access is restricted to authorized personnel using identity-federated paths.

Environment separation. Production, staging, and development environments are logically separated, with separate credentials, separate data stores, and separate secrets.

Customer authentication. The Platform supports:

• JWT-based access tokens with a 15-minute expiry and refresh tokens with a 7-day expiry, using family-based rotation that detects refresh-token reuse and revokes a compromised family
• Single Sign-On (SSO) via OAuth 2.0 and OpenID Connect, with production integrations available for Okta, Microsoft Entra ID (Azure AD), and Google Workspace, including just-in-time provisioning
• API keys stored only as SHA-256 hashes, never in plaintext at rest
• Multi-factor authentication (MFA) via TOTP, with QR-code enrollment and one-time backup codes
• Password security using bcrypt with appropriate cost factor, with complexity and rotation rules configurable at the tenant level

Role-based access control (RBAC). A unified RBAC system enforces six standard roles across analysis, API management, and UI surfaces. Permissions are checked server-side on every request. Customers can configure role assignments at the tenant level.

Session management. Sessions are tracked through refresh-token families with configurable maximum concurrent sessions and configurable inactivity timeouts.

Internal access. FalsiFind personnel access to production is governed by least-privilege principles, requires SSO and MFA, is logged, and is reviewed on a recurring cadence. Production data access is limited to a small set of personnel with a documented business need.

Encryption in transit. All connections to the Platform and the Website use TLS 1.2 or higher, with modern cipher suites and HSTS. Internal service-to-service traffic is also encrypted in transit.

Encryption at rest. Data at rest, including databases, object storage, backups, and managed cache, is encrypted using AES-256 or equivalent provider-managed encryption.

Key management. Cryptographic keys are managed through cloud-provider key management services with separation of duties for key administration and access. Customer secrets, including API keys, are stored only as cryptographic hashes; SSO client secrets and other operational secrets are stored in encrypted secret stores.

Data classification. We classify data according to a documented schema and apply handling rules (encryption, access, retention, logging) according to classification.

The Platform is designed to minimize the persistent storage of raw customer media and to make the integrity of analysis results independently verifiable.

Minimized media retention. Raw customer media submitted for analysis, along with associated analysis artifacts, are retained for up to 45 days solely for evidence integrity, audit, chain-of-custody verification, dispute resolution, and incident response. After this window, raw media and associated artifacts are deleted from production systems.

Evidence bundles. Analysis output is captured in cryptographically signed JSON evidence bundles. Bundles are signed with RSA-PSS signatures, and a SHA-256 hash chain links sequential analyses to support chain-of-custody verification. Evidence bundles contain analysis results and metadata; they do not contain raw media.

No customer data used to train models. We do not use customer-submitted media, customer Platform Data, or any account telemetry to train, fine-tune, or otherwise improve our detection models or any third-party foundation model. Model improvement is performed exclusively against licensed and synthetic training datasets governed by our internal data-sourcing standards.

Data subject rights support. The Platform supports GDPR-style data export and deletion workflows for customer-administered end-user data.

Code review. All code changes are peer reviewed and merged through a documented pull-request workflow. Changes affecting security-sensitive surfaces require additional review.

Static and dynamic analysis. We use static application security testing (SAST), dependency vulnerability scanning, and secret scanning in our CI pipeline. We perform dynamic application security testing (DAST) on a recurring cadence.

Software composition. We maintain an inventory of open-source components and track their licenses and known vulnerabilities. We treat copyleft licenses (including AGPL and SSPL) as restricted by default and approve OSS use through a documented intake process. Software Bills of Materials (SBOMs) are produced for the Platform.

Vulnerability management. Vulnerabilities are triaged on disclosure, with remediation timelines tied to severity. We track remediation against documented service-level objectives.

Penetration testing. We engage qualified third-party testers to perform penetration testing on a recurring cadence and after material architectural changes. Summary letters are available to enterprise customers under NDA.

Container and dependency hygiene. Production runtimes use pinned base images and pinned Python and Node versions. Dependencies are kept current against published advisories.

Audit logging. Authentication events, administrative actions, API access, analysis events, and configuration changes are logged. Logs are protected against tampering and retained according to documented schedules.

Monitoring. Production environments are continuously monitored for availability, performance, error rates, and anomalous activity. Alerts are routed to on-call personnel.

Detection and response. Security-relevant events are reviewed and triaged. We maintain documented playbooks for the most common incident classes.

Bot detection and fraud prevention. Public-facing Website forms (demo requests, newsletter signups, gated content downloads, AI chat assistant) are protected by Cloudflare Turnstile to verify human interaction and to defend against automated abuse, credential stuffing, and form-flood attacks.

Plan. We maintain a written incident response plan that defines roles, escalation paths, decision authorities, and communication procedures, and we conduct tabletop exercises at a cadence appropriate to our risk profile.

Notification commitment. In the event of a security incident affecting customer data, we will notify affected customers without undue delay and in accordance with applicable law and the customer’s subscription agreement, with target notification consistent with GDPR Article 33 (72 hours), NYDFS Part 500 (72 hours where applicable), CIRCIA (72 hours, 24 hours for ransomware payments where applicable), and US state breach-notification statutes as they apply to the affected data and jurisdictions.

Forensics and evidence. We engage privileged counsel-led forensics for material incidents and preserve evidence accordingly.

Coordination. We coordinate with cyber insurance carriers, law enforcement (FBI IC3, CISA, Secret Service as appropriate), and regulators as required.

Backups. Production databases are backed up on a documented schedule. Backups are encrypted at rest and tested for restorability.

High availability. Critical Platform services are deployed with redundancy across availability zones. The deployment pipeline supports rolling updates and rapid rollback.

Recovery objectives. We maintain documented Recovery Point and Recovery Time Objectives appropriate to the service tier. Specific RPO/RTO commitments are made in customer subscription agreements.

Testing. Backup restoration and failover procedures are tested on a recurring cadence.

We use a small set of vetted third parties to operate the Platform and the Website. Each is subject to a documented due-diligence and risk-rating process, written contractual security and privacy obligations, and ongoing monitoring. The current list is:

Trust center note: For the Fay conversational assistant, Anthropic Claude is used with Zero Data Retention (ZDR) enforced at the API key level. This means conversation content is processed in-flight for inference only and is never stored by Anthropic or used to improve their models.

Enterprise customers receive an updated sub-processor list and material-change notifications under their Data Processing Addendum.

A detailed description of certifications, attestations, and frameworks is on our Compliance page. In summary:

• SOC 2 Type II: in progress, targeted completion in line with our published roadmap
• ISO/IEC 27001: in progress
• GDPR / UK GDPR: operational
• CCPA / CPRA and US state privacy laws: operational
• PIPEDA and Quebec Law 25: operational readiness
• NYDFS Part 500 alignment: operational, designed for financial-sector buyers
• GLBA Safeguards alignment: operational
• NIST AI Risk Management Framework: alignment
• EU AI Act: posture under development consistent with phased application timeline

We do not claim certifications we do not hold. Where work is in progress, we say so.

The Platform’s security posture depends in part on choices made by each customer. Customers are responsible for:

• Configuring SSO, MFA, RBAC, session controls, and password policy at the tenant level
• Managing user lifecycle, including provisioning and deprovisioning
• Protecting API keys and rotating them on a schedule appropriate to the customer’s environment
• Reviewing audit logs available to the customer
• Submitting only data the customer is authorized to submit, and not submitting data outside the scope of the subscription
• Ensuring that any integration of FalsiFind output into automated decision-making includes appropriate human oversight, contestability, and disclosure under applicable law

If you believe you have found a security vulnerability affecting FalsiFind, please report it to security@falsifind.com. We ask that you give us a reasonable opportunity to investigate and remediate before public disclosure, that you do not access or modify data beyond what is necessary to demonstrate the issue, and that you avoid actions that would degrade service for others.

We do not currently operate a paid bug-bounty program. We recognize good-faith reporters and will work with you on attribution and remediation timelines.

FalsiFind operates Fay, a conversational AI assistant available on the marketing website. Fay is designed to answer questions about the FalsiFind platform and to help qualified prospects book a product demo.

What Fay does. Fay answers questions grounded in our published product documentation and marketing content. It will not answer questions outside that scope and is designed to refuse requests for legal, financial, or investment advice, and to decline requests unrelated to FalsiFind products.

How Fay is powered. Fay uses Anthropic Claude for language inference and Voyage AI + Cohere for knowledge retrieval and reranking. All three vendors are listed in the sub-processor table in Section 10 above, along with their data-retention commitments.

Data retention and ZDR. Anthropic Zero Data Retention (ZDR) is enforced at the API-key level. Conversation content sent to Claude is processed in-flight for inference only and is never stored by Anthropic or used to train their models. Voyage AI and Cohere are stateless (no retention per their API agreements). FalsiFind retains session telemetry (turn count, latency, intent signals, and satisfaction scores) for up to 90 days for quality and safety evaluation, with no raw conversation text retained beyond individual turn processing.

No customer data used for training. FalsiFind does not use any Fay conversation content to fine-tune, train, or improve any AI model.

Your data rights. You may request deletion of your Fay session data at any time via the data request form or by emailing privacy@falsifind.com. We will respond within 30 days.

Rollout and availability. Fay is deployed via a feature-flag system that controls which pages the widget appears on and what percentage of visitors see it. The widget is never shown on this page, on the contact page, or on any other legal page. Engineering and marketing operations review Fay’s quality metrics weekly; the operational runbook is maintained at docs/fay-runbook.md in the engineering repository.

Under NDA, enterprise customers and prospects can request:

• Penetration test summary letters
• Architecture and data-flow diagrams
• Sub-processor list with material-change notification commitments
• Data Processing Addendum, including Standard Contractual Clauses and the UK Addendum where applicable
• Security questionnaire responses (SIG Lite, SIG Core, CAIQ)
• Incident response plan summary
• Business continuity and disaster recovery summary
• Audit reports and certifications, when issued

Email: security@falsifind.com
Mail:
Obscurae Intelligence Inc.
Attn: Security
522 West Riverside Ave., #8054
Spokane, WA 99201
United States

FalsiFind is a product of Obscurae Intelligence Inc., a Delaware corporation.