Security — Product Investment Intelligence

Security is foundational to Product Investment Intelligence. Fathomkey operates an information security program designed to protect customer data, maintain service availability, and meet enterprise compliance requirements. This page summarizes our security practices.

1. Compliance and certifications

Fathomkey's security program is aligned with ISO/IEC 27001 and SOC 2 (Type II program in operation). We maintain policies and controls across access management, change management, incident response, vendor risk, and business continuity. SOC 2 reports and security documentation are available to enterprise customers on request.

2. Infrastructure

Product Investment Intelligence is built on Supabase with PostgreSQL, hosted on enterprise-grade cloud infrastructure. Key infrastructure controls include:

Encryption in transit (TLS 1.2+) for all connections
Encryption at rest (AES-256) for stored data
PostgreSQL Row-Level Security (RLS) for tenant data isolation
Segregated production, staging, and development environments
Automated backups with tested restore procedures
Geographic data residency options for enterprise customers

3. Application security

JWT-based authentication with secure session management
Role-based access control (Owner / Full Access / View Access) enforced at database and UI level
Rate-limited AI endpoints to prevent abuse
Input validation and output encoding across all API surfaces
Secure software development lifecycle (SDLC) with code review and dependency scanning
Regular vulnerability assessments and penetration testing

4. Access controls

Fathomkey enforces least-privilege access for all internal systems. Production access requires multi-factor authentication (MFA). Access is reviewed quarterly and revoked upon role change or departure. All production access is logged and monitored.

Enterprise customers can enable SSO/SAML and SCIM provisioning for their organization's users, with advanced audit export for compliance teams.

5. AI security

Product Investment Intelligence's AI features are designed with security and privacy by default:

Customer content is not used to train foundation models
Only evidence required for the requested task is sent to a model
AI outputs are scoped to the originating workspace
Sub-processors are contractually prohibited from training on customer data
Models are evaluated for safety, accuracy, and hallucination before release

6. Monitoring and incident response

We maintain continuous logging and monitoring across all production systems. Anomalies trigger automated alerts to our security team. Our incident response plan defines detection, containment, eradication, recovery, and notification timelines. Customers are notified of security incidents affecting their data within seventy-two (72) hours, as described in our Data Processing Addendum.

7. Vendor risk management

All sub-processors undergo security review before engagement and are re-assessed annually. Sub-processors are bound by written agreements imposing confidentiality, security, and data-protection obligations at least as protective as our own policies.

8. Responsible disclosure

If you discover a security vulnerability in Product Investment Intelligence, please report it responsibly to choudhary[@]fathomkey.pro. We ask that you:

Provide sufficient detail to reproduce the issue
Allow reasonable time for us to investigate and remediate before public disclosure
Not access or modify data belonging to other customers
Not perform denial-of-service attacks or social engineering

We acknowledge valid reports within two business days and will work with you to understand and resolve the issue.

9. Enterprise security

Enterprise plans include additional security capabilities:

SSO/SAML and SCIM user provisioning
Advanced audit log export
Custom data retention and deletion policies
Dedicated security questionnaires and compliance documentation
Custom MSAs and DPAs
99.9% uptime SLA option

10. Contact

Fathomkey
Hyderabad, Telangana
Security inquiries: choudhary[@]fathomkey.pro