Security evidence package
A current-deployment summary of implemented architecture, access controls, audit records, and service boundaries.
This summary describes implementation evidence, not an independent security audit or a claim that every control has passed live adversarial testing.
Current deployment
The portal and marketing site run on Vercel. Portal database and authentication use Supabase. Titan AI™ runs as titan-app on Google Cloud Run with a Neon Postgres database. Theta AI™ pipeline jobs run in GitHub Actions. Transactional email uses Resend.
All current public surfaces use HTTPS through Vercel, Google Cloud Run, and Supabase APIs.
Accounts that enroll TOTP are held to the higher assurance level: middleware checks AAL on protected portal requests and redirects sessions without step-up to the MFA challenge.
Login controls use an IP-and-email key (8 attempts per 5 minutes), generic anti-enumeration errors, and fail closed if the rate-limit check errors.
Server Actions use the shared permission layer and dedicated checks for sensitive flows, including holder binding, company attestors, and platform-admin access. Candidate links use a dedicated token flow; the superadmin console is outside the customer route group.
Candidate invitation links use a dedicated token-resolution flow. The superadmin console is outside the customer route group.
Stripe uses hosted Checkout and a signed webhook, so card data does not touch AI Psychometrics Inc. servers. The secret key is server-side only.
The portal records session, candidate, and administrative events in audit_logs. Inserts are best-effort; billing movements are recorded in the credit ledger.
The campaign bulk-upload CSV path validates every file in-house (extension, MIME, size, binary structure, encoding, and control-byte checks) before processing.
Current service providers named in the repository are Vercel, Supabase, Google Cloud Run, Resend, Stripe, and GitHub Actions. These providers form the current service boundary.
Evidence artifacts
Draft Privacy Policy and Terms of Service (pre-legal-review)
MFA-enforcing middleware and /mfa-challenge flow
0004 rate-limit migration
Audit-log interface and audit helpers
Canonical score contract v1 · 2026-09-21
Calibration provenance JSON · 2026-09-21 · run 35553441453
