Security Questions
Direct answers to the questions enterprise security teams, procurement reviewers, and technical evaluators raise most often. Certifications are scoped alongside the commercial engagements that require them — the architecture is built to carry every one of them.
SOC 2
AegisWire's engineering practices — logical access control, change management, continuous monitoring, encryption, incident response — are structured against the SOC 2 Trust Service Criteria. The evidence bundle that would feed a Type II audit is produced and maintained today.
The formal SOC 2 engagement is scoped alongside the commercial contract that requires it, rather than carried on the marketing site as a generic certificate. If your procurement requires SOC 2 Type II at signing, raise it in the commercial conversation and we will scope the auditor work alongside the engagement.
ISO 27001
Information security management practices are documented and followed internally: access control policy, secure development lifecycle, incident response, asset management, supplier risk, and cryptographic controls.
The ISO 27001 certification engagement is scoped alongside the customer contract that triggers it — the ISMS documentation is already written to drop into the audit scope.
HIPAA
AegisWire ships the technical controls healthcare operators require: quantum-resistant encryption at rest and in transit, per-tenant isolation, comprehensive tamper-evident audit logging, and role-based access control.
HIPAA has no formal certification — it is a statutory framework enforced through Business Associate Agreements. A negotiated BAA and a formal HIPAA security risk assessment are bundled with healthcare engagements.
How do you test security?
Security testing is internal and founder-led. The founding team has cryptographic engineering background and performs adversarial testing against the platform continuously.
No external penetration test has been conducted. This is on our roadmap.
What data do you store?
We do not store, inspect, or log tunnel traffic content. AegisWire sees routing metadata only.
Can you offer self-hosted deployment?
AegisWire supports three deployment models, all running the same security architecture:
Do you support customer security reviews?
Yes. We welcome security reviews as part of procurement evaluation. We can provide:
- Architecture documentation and security design overview
- Completed security questionnaires (CAIQ, SIG, or your format)
- Data processing addendum and privacy documentation
- Direct technical discussion with the engineering team
Contact security@aegiswire.com to begin a review.
How do you handle vulnerabilities?
We maintain a published Vulnerability Disclosure Policy with safe harbour provisions for good-faith security researchers.