Information Security Policy (ISP)

Document Reference: AUC-SEC-POL-001
Version: 3.2.0
Effective Date: October 24, 2026
Last Updated: October 24, 2026
Classification: Internal / Auditor Access
Framework Alignment: ISO/IEC 27001:2022 Control Alignment | SOC 2 Type II (Trust Services Criteria) | NIST CSF 2.0 | NIST SP 800-53 Rev. 5

Executive Summary (ISO 24495-1 Plain-Language Overview)

[!IMPORTANT] Legal Precedence Notice: This plain-language summary is provided solely for reader convenience and cybersecurity audit navigation pursuant to ISO 24495-1:2023. It reflects corporate security baselines and management policies. In the event of any conflict, governing contractual security commitments and operative policy articles strictly prevail.

• Security Mandate: Establishes Auctoric’s Information Security Management System (ISMS) designed to comply with ISO/IEC 27001:2022, SOC 2 Type II, and NIST CSF 2.0.
• Zero Trust IAM: Enforces centralized single sign-on (SSO), mandatory FIDO2 hardware keys (WebAuthn/YubiKey) for production systems, and just-in-time (JIT) least-privilege access.
• Cryptographic Architecture: Requires AES-256 at rest, TLS 1.3 in transit, FIPS 140-3 KMS key management, and customer-managed encryption key (CMEK) support.
• Strict Vulnerability SLAs: Critical vulnerabilities (CVSS 9.0–10.0) patched within 24 hours; High vulnerabilities (CVSS 7.0–8.9) patched within 7 days.
• Resilience Targets: Multi-region business continuity delivering Recovery Point Objective (RPO) < 1 hour and Recovery Time Objective (RTO) < 4 hours.

High-Intent Security FAQ (AEO Direct Answers)

What cryptographic standards protect customer data at rest and in transit?

Under Section 5, Auctoric enforces AES-256 encryption at rest across all databases, object buckets, and vector caches, and TLS 1.3 in transit with forward secrecy. Cryptographic keys are managed via FIPS 140-3 validated KMS modules with 365-day automated rotation.

What are Auctoric’s remediation timelines for software vulnerabilities?

Under Section 7, Auctoric commits to strict CVSS remediation SLAs: Critical (CVSS 9.0–10.0) in < 24 hours, High (CVSS 7.0–8.9) in < 7 days, Medium in < 30 days, verified by annual independent third-party penetration testing.

What are Auctoric’s Disaster Recovery (DR) and business continuity targets?

Under Section 9, Auctoric’s multi-region cloud architecture maintains a Recovery Point Objective (RPO) of < 1 hour for database state and vector indexes, and a Recovery Time Objective (RTO) of < 4 hours for full regional inference failover.

1. Objective and Executive Commitment

This Information Security Policy (“ISP”) defines the organizational framework, operational mandates, and technical controls established by Auctoric, LLC (“Auctoric”) to preserve the Confidentiality, Integrity, and Availability (CIA Triad) of Auctoric information assets, customer data, and AI platform infrastructure.

Auctoric leadership is committed to maintaining an Information Security Management System (ISMS) engineered and managed to comply with ISO/IEC 27001:2022 and SOC 2 Type II (Trust Services Criteria) standards.

2. Scope & Organizational Governance

2.1 Scope

This policy applies to all systems, networks, physical offices, cloud environments (enterprise cloud service providers), employees, contractors, third-party vendors, and services operated by Auctoric globally.

2.2 Roles and Responsibilities

• Board of Directors / Audit Committee: Exercises executive oversight of the cybersecurity risk posture.
• Chief Information Security Officer (CISO): Directly accountable for the implementation, continuous monitoring, and enforcement of this ISP and ISMS controls.
• Security Operations Center (SOC): Operates 24/7/365 to triage alerts, investigate anomalous events, and execute incident containment.
• All Personnel: Mandatory obligation to uphold security practices, complete annual compliance training, and immediately report suspicious events.

3. Data Classification & Handling Matrix

All information created, stored, or processed at Auctoric is classified into four distinct tiers:

4. Identity & Access Management (Zero Trust Architecture)

Auctoric enforces a Zero Trust security model: “Never trust, always verify.”

4.1 Authentication & Multi-Factor Authentication (MFA)

• Centralized Identity Provider (IdP): All access to production, corporate applications, and code repositories must authenticate through centralized single sign-on (SSO).
• FIDO2 / Hardware Security Keys: Mandatory phishing-resistant MFA (WebAuthn / YubiKey) is enforced for all production cloud consoles, code deployment pipelines, and administrative bastions. SMS/voice OTP is strictly prohibited.

4.2 Principle of Least Privilege and Role-Based Access Control (RBAC)

• Access is granted solely based on verified business necessity.
• Just-In-Time (JIT) Elevation: Production environment access requires ephemeral, time-bounded JIT privilege elevation, requiring ticket approval and multi-party sign-off.
• Access privileges are audited quarterly; stale accounts are deactivated automatically after thirty (30) days of inactivity.

5. Cryptographic Architecture & Key Management

Auctoric mandates industry-standard cryptographic primitives:

• Data in Transit: TLS 1.3 enforced across all external and internal microservice APIs with forward secrecy. Insecure legacy protocols are permanently disabled at the edge.
• Data at Rest: All databases, object storage buckets, block storage volumes, and vector caches are encrypted using AES-256.
• Key Management Service (KMS): Cryptographic keys are generated, stored, and managed using FIPS 140-3 validated Hardware Security Modules (HSMs) and Key Management Services (KMS). Keys are rotated automatically every 365 days.
• Customer-Managed Encryption Keys (CMEK): Enterprise customers can provide and control their own KMS key ARNs for dedicated storage buckets where supported.

6. Network Security & Cloud Architecture

flowchart LR
    User["Client Request"] --> DDoS["Enterprise Cloud Edge WAF & L3-L7 DDoS Shield"]
    DDoS --> WAF["Cloud WAF & API Rate Limiting"]
    WAF --> mTLS["mTLS API Gateway"]
    mTLS --> VPC["Isolated Production Virtual Private Cloud (VPC)"]
    subgraph VPC["Production VPC (Microsegmented)"]
        K8s["Hardened Container Orchestration Cluster"]
        LLM["Inference Serving Pods"]
        Vector["Dedicated Tenant Vector Index"]
        DB[(Encrypted Managed Database Cluster)]
    end
    K8s <--> LLM
    K8s <--> Vector
    K8s <--> DB

• Microsegmentation: Workloads operate inside isolated Virtual Private Clouds (VPCs) with strict perimeter controls and zero direct public ingress to databases or inference workers.
• Mutual TLS (mTLS): Service mesh enforces mTLS encryption and cryptographic workload identity between internal microservices.
• DDoS & Web Application Firewall (WAF): Real-time automated mitigation of volumetric DDoS, SQL injection, cross-site scripting (XSS), and OWASP Top 10 vulnerabilities.

7. Vulnerability Management & Patching SLAs

Auctoric conducts continuous automated vulnerability scanning across infrastructure, source code, and container images:

Third-party independent penetration tests are executed at least annually and following major platform architectural updates.

8. Incident Management & Forensics

Auctoric maintains a formal Computer Security Incident Response Plan (CSIRP) aligned with NIST SP 800-61 Revision 3:

1. Detection & Triage: 24/7 SIEM monitoring with automated anomaly detection across cloud audit trails (Cloud Audit Logs, VPC Flow Logs).
2. Containment: Automated isolation of compromised containers or revoked API keys within minutes.
3. Eradication & Recovery: Restoration from immutable, verified backups.
4. Post-Incident Review: Root Cause Analysis (RCA) published within five (5) business days following incident closure.

9. Business Continuity (BCP) & Disaster Recovery (DR)

Auctoric maintains multi-region architecture designed to withstand cloud infrastructure failure:

• Recovery Point Objective (RPO): < 1 Hour for database state and vector indexes.
• Recovery Time Objective (RTO): < 4 Hours for full regional failover of AI inference pipelines.
• Backup Testing: Automated restoration simulations performed quarterly; DR failover drills executed annually.

10. Personnel Security & Compliance Enforcement

• Background Checks: All prospective personnel undergo background checks prior to offer confirmation, consistent with local labor laws.
• Mandatory Training: Annual security awareness training, secure coding training for engineers (covering OWASP Top 10 and OWASP LLM Top 10), and simulated phishing exercises.
• Enforcement: Violations of this policy will result in formal disciplinary action up to and including termination of employment.

11. Policy Review & Compliance Alignment

This policy is reviewed annually by the CISO. Controls are engineered to comply with ISO/IEC 27001:2022, ISO/IEC 42001:2023, and SOC 2 Type II control criteria.

• Security & Incident Response: security@auctoric.ai
• Incident Intake Portal: https://trust.auctoric.ai/security/report
• CISO Direct Contact: ciso@auctoric.ai