Security evidence package
A current-deployment summary grounded in repository implementation and named service boundaries. It is not a certification and does not promise controls that have not been verified.
Current deployment
The portal and marketing site run on Vercel. Database and authentication use a single Supabase project. Titan runs as titan-app on Google Cloud Run. Theta pipeline jobs run in GitHub Actions. Transactional email uses Resend.
All current public surfaces use HTTPS through Vercel, Google Cloud Run, and Supabase APIs.
Supabase Auth uses email and password with enforced TOTP MFA. Middleware checks the authentication assurance level on protected portal requests and redirects sessions without step-up to the MFA challenge.
Login controls use an IP-and-email key, anti-enumeration behavior, and a fail-open mode if the rate-limit RPC errors.
Companies and company_members implement role-based access. PERMISSIONS/can() is the shared authorization source enforced in Server Actions. Row-level security and campaign-entitlement coverage are withheld here pending a complete production-policy review.
Candidate invitation links use a dedicated token-resolution flow. Token generation, storage, rotation, and expiry details are withheld here pending a complete production review. The superadmin console is outside the customer route group.
Secrets are held in Vercel environment variables or GitHub Secrets, not in code or messages. Stripe uses a restricted key and webhook signing secret. Checkout is Stripe-hosted, so card data does not touch AI Psychometrics servers.
The portal records session and candidate-system events in audit_logs, administrative events in admin logs, and billing movements in the credit_ledger.
The campaign bulk-upload CSV path scans every uploaded CSV with VirusTotal before processing. Known hashes use reputation lookup; unknown files use asynchronous full scanning with retries and backoff. A malicious result is logged and surfaced for human action rather than silently deleting the file.
Current service providers named in the repository are Vercel, Supabase, Google Cloud Run, Resend, Stripe, GitHub Actions, and VirusTotal. Naming a provider describes the current architecture; it is not a certification claim.
Evidence artifacts
Live Privacy Policy and Terms of Service
MFA-enforcing middleware and /mfa-challenge flow
0004 rate-limit migration
Audit-log interface and audit helpers
Canonical score contract v1 · 2026-09-21
Calibration provenance JSON · 2026-09-21 · run 35553441453
Not yet published
These items remain visible so a buyer can distinguish a missing artifact from an affirmative control claim.
