PASSRestore drill
Enterprise Trust Center
Evidence before assurance claims.
Security, provenance, resilience and procurement status are published with explicit boundaries. Planned certifications are never presented as completed.
DailyR2 database backup
SHA-256Remote integrity verification
100/100DATA10 quality gate
Implemented controls
HTTPS/HSTS, restricted production CORS, public dotfile blocking, environment-based secrets, audit/event persistence, checksum-verified R2 backups, restore testing, report provenance and QA gates.
Enterprise access layer
Organizations, workspaces, RBAC, memberships, revocable sessions, hashed API keys, scopes, quotas, usage metering and audit trails are implemented in the enterprise application/schema. Production activation remains subject to the application-service reload gate.
Data integrity
Clinical evidence used in analytical ranking is limited to records classified as in_scope or related. Out-of-scope records remain traceable but are excluded from enterprise evidence calculations.
External assurance roadmap
Independent penetration testing, SOC 2 Type II and ISO/IEC 27001 are planned milestones. NeuroRisk.ai does not currently claim those certifications.
SSO and provisioning
OIDC/SAML/SCIM configuration models exist, but availability is not claimed until each integration passes end-to-end validation for the customer organization.
Data rights
Technical provenance is implemented. Commercial-use, redistribution and storage rights remain subject to source-by-source legal review before contractual dataset-licensing claims.
Procurement package
Security whitepaper and incident-response drafts exist internally. DPA, subprocessor register, formal data-rights review and external assurance artifacts require the appropriate legal/security approval before execution or publication.
Request enterprise security review →