Trust & Compliance

This page lists the security testing PVSN runs on its own systems and the compliance certifications we have, are working toward, or inherit from our infrastructure providers.

See /security for the architectural overview (encryption, access control, sub-processors). This page is the operational counterpart — what we test, how often, and what we do when we find something.

Certifications & audits

• In progress
  SOC 2 Type I

  Internal controls + 15 policies in place; auditor engagement pending. Gate: first enterprise contract or 3+ prospects requesting.
• Planned
  SOC 2 Type II

  Begins after Type I. 6–12 month observation window before the report is issuable.
• In place
  GDPR

  Right-to-access (/v1/gdpr/export) and right-to-erasure (/v1/gdpr/delete) endpoints live. DPA available on request.
• In place
  CCPA / CPRA

  Data-minimization defaults. No sale of personal information. CCPA-aligned Service Provider terms in our DPA.
• Inherited
  PCI DSS Level 1

  Card data is processed entirely by Stripe. PVSN never stores or transmits cardholder data. Compliance inherited from Stripe's certification.

Automated security testing

Every code change runs multiple security scanners in CI — Bandit (SAST), a dependency vulnerability audit, and ESLint security rules — and a weekly ZAP baseline scan runs against the deployed system. Findings are surfaced for review on every run.

Penetration testing

We don't yet have a third-party penetration test on file. Our honest plan:

• Today: the automated scans above (gitleaks + bandit + safety + Dependabot + eslint-security + Trivy + ZAP baseline) catch the majority of common findings continuously.
• Trigger to commission a paid test: first of — an enterprise prospect requesting it in writing, SOC 2 Type II observation window beginning, or a defined ARR threshold.
• Likely vendor: Cobalt.io ($8–15K per test, Pentest-as-a-Service). Larger firms (Bishop Fox, NCC) reserved for explicit prospect demand.
• Report distribution: the executive summary becomes a customer-shareable PDF; full findings stay internal until remediated.
• Ongoing program: within ~6 months of the first pentest, evaluate continuous bounty (HackerOne or Bugcrowd) as a complement.

Prospects whose vendor security policy requires a recent third-party pentest report: please reach out. We can typically commission a targeted Cobalt test within ~3 weeks of an executed contract.

Responsible disclosure

Found a vulnerability? Email security@pvsnapp.com with reproduction steps. We commit to:

• Acknowledgment within 24 hours
• Triage and severity within 72 hours
• Remediation per severity: Critical 24h · High 7d · Medium 30d · Low 90d
• Hall-of-Fame credit (or anonymous on request)
• No legal action against good-faith researchers

Machine-readable contact: /.well-known/security.txt .

Internal audit cadence

• Quarterly access reviews across Railway, GitHub, Stripe, Anthropic, Google Workspace, Vercel, internal tooling.
• Annual risk assessment: documented identification + scoring + treatment across security, availability, privacy, financial, strategic categories.
• Annual policy review for all 15 SOC 2 policies in our compliance repository.
• Annual restore drill: full Postgres backup restored to a non-production database, verifying RTO + known-row presence.
• Annual incident-response tabletop: blameless walkthrough of a hypothetical scenario against the runbook.