1. Program
Anyue operates an information security program aligned to ISO/IEC 27001 and ISO/IEC 42001, overseen by the CTO with quarterly reporting to the board's audit committee. Policies are reviewed annually and after any Severity-1 incident.
2. Certifications and assessments
- SOC 2 Type II — security, availability, confidentiality (2026 report available under NDA);
- ISO/IEC 27001 and ISO/IEC 27701 certified; ISO/IEC 42001 AI management system;
- HIPAA — Business Associate Agreements available for healthcare customers;
- GDPR / UK GDPR and CCPA/CPRA aligned DPA with a maintained subprocessor list;
- FedRAMP — In Process (agency sponsor), target authorization 2027.
3. Data protection
TLS 1.3 in transit; AES-256 at rest with customer-managed keys (BYOK) available; production and staging isolated at the account and network layer; test data de-identified or synthetic. In VPC and on-premises deployments, customer data never leaves the customer's boundary; Anyue engineers access only through customer-authorized bastion sessions, recorded and retained 180 days.
4. Secure development and supply chain
Mandatory code review, SAST/DAST in CI, SCA with license checks, signed container images and reproducible builds, progressive rollout with automated rollback. Model and data vendors pass annual due diligence and sign DPAs; no customer data is used to train shared models without a written opt-in.
5. Testing and disclosure
Third-party penetration tests and red-team exercises run quarterly; critical findings are remediated within 7 days, high within 30. Report vulnerabilities to security@anyue.org; we acknowledge within 2 business days and will not pursue legal action for good-faith research conducted under our safe-harbor terms.
6. Incident response
| Phase | Action | Target |
|---|---|---|
| Triage | On-call engineer confirms scope and severity | 15 minutes |
| Containment | Isolate affected instances; preserve forensic images | 1 hour |
| Notification | Written notice to affected customers with facts and remediation | 24 hours |
| Post-mortem | Root-cause analysis and tracked corrective actions | 10 business days |
7. Compliance posture
Anyue supports customer audits with a shared-responsibility matrix, SOC 2 bridge letters, and completed security questionnaires (CAIQ, SIG). Data residency options include US, EU and customer-controlled environments. Contact security@anyue.org for the security package.