# Security, in plain language.

Everything a bank security team needs to evaluate Astra: our controls, our sub-processors, where to send a vulnerability report, and how we respond when something goes wrong.

## Report a vulnerability

security@codeastra.dev

PGP key available on request. Acknowledgement within 24 hours. Safe-harbor for good-faith research.

[Email security](mailto:security@codeastra.dev)

## Controls

### What we do, end to end.

#### Encryption

TLS 1.3 in transit. AES-256 at rest. Customer-held KMS keys (AWS KMS / Azure Key Vault) on roadmap for enterprise tier.

#### Deployment isolation

Cloud (multi-tenant), Hybrid (local vault + cloud LLM), and full Air-Gap Docker. Vault never co-locates with reasoning model.

#### Access control

Per-user, per-token RLS at the database layer. ES256-signed agent credentials. Master Admin keys are tenant-scoped.

#### Audit logging

Hash-chained, append-only. Every prompt, token resolution, and executor action recorded. Exportable in JSON or CSV.

#### Incident response

Acknowledgement within 24 hours of report. Initial assessment within 72 hours. Customer notification per contract.

## Sub-processors

### Every vendor that may touch your data.

On-prem and air-gap deployments call none of the sub-processors below. Cloud-tier customers can disable any LLM provider at the policy layer.

- **Supabase (AWS us-east-1)**
  - Managed Postgres, auth, edge functions  
   🇺🇸 US-East
- **Cloudflare**
  - DNS, edge CDN, DDoS protection  
   🌐 Global
- **Anthropic**
  - LLM inference (opt-in, no-training header sent)  
   🇺🇸 US
- **OpenAI**
  - LLM inference (opt-in, zero-retention API)  
   🇺🇸 US
- **Google Vertex AI**
  - LLM inference (opt-in, EU/US locality available)  
   🇪🇺 EU / 🇺🇸 US
- **Stripe**
  - Billing and subscription management  
   🇺🇸 US / 🇮🇪 EU
- **Resend**
  - Transactional email (notify.codeastra.dev)  
   🇺🇸 US

Material changes to this list are communicated to enterprise customers at least 30 days in advance.

## Data handling

### What we promise. In writing.

- We never train any LLM on your data. We send no-training headers (e.g. anthropic-beta: no-training-1) on every upstream call.
- Sensitive values are tokenized before leaving your VPC. The reasoning model only sees opaque tokens like cdt_a3f9.
- Zero-logging fallback: when enabled, prompts and responses are not persisted by Astra at all.
- Customer data is never used for product analytics, fine-tuning, or evaluation without explicit written consent.
- Data deletion requests are honored within 30 days. Audit logs may be retained per your contractual recordkeeping window.
- On-prem and air-gap modes ship as a self-built Docker image; no telemetry leaves your perimeter.

## Documents

### Available on request.

- [Security Architecture Deep Dive  
  12-page CISO whitepaper · trust model, data flow, controls, roadmap](/content/documents/Astra_Security_Architecture_Whitepaper.pdf)  
- [Regulatory Map (one-pager)  
  GLBA · SEC 17a-4 · FINRA · SOX · DORA · EU AI Act · MAS · PCI](/content/documents/Astra_Regulatory_Map.pdf)  
- [DPA (Data Processing Agreement)  
  GDPR Art. 28 standard contractual clauses · email request](mailto:security@codeastra.dev?subject=Document%20request:%20DPA)  
- [Pen-test summary letter  
  Most recent third-party engagement · email request under NDA](mailto:security@codeastra.dev?subject=Document%20request:%20Pen-test%20summary)

## Need a signed DPA or full questionnaire?  We turn them around in 48 hours.

- [Request a Pilot](/content/contact-sales/index.html)  
- [Contact us](mailto:mpkobed@driftlayer.dev)