Security Policy

Last updated: April 8, 2026

1. Our Commitment

Security is foundational to the SYSTEM9 platform. As a sovereign distributed data platform serving military, government, and enterprise customers, we hold ourselves to the highest standards of information security. Our security program is designed to protect the confidentiality, integrity, and availability of customer data and platform infrastructure at every layer of the stack.

2. Infrastructure Security

SYSTEM9 cloud-managed deployments are hosted on Microsoft Azure, leveraging Azure's enterprise-grade physical security, network infrastructure, and compliance certifications. Our infrastructure security measures include:

• Encryption at Rest: All data at rest is encrypted using AES-256 encryption. Encryption keys are managed through dedicated key management systems with strict access controls.
• Encryption in Transit: All data in transit is protected using TLS 1.3 or higher. Internal service-to-service communication uses mutual TLS (mTLS) to authenticate both endpoints.
• Network Isolation: Customer environments are logically isolated using virtual networks, network security groups, and private endpoints. No customer data traverses the public internet unless explicitly configured by the customer.
• DDoS Protection: The platform is protected by Azure DDoS Protection Standard, providing always-on traffic monitoring and automatic attack mitigation.

3. Application Security

Security is integrated into every phase of our software development lifecycle (SDLC):

• Secure Development: All code is developed following secure coding guidelines and undergoes mandatory peer code review before merging. Security considerations are addressed during design and architecture reviews.
• Code Review: Every change to the codebase requires review and approval by at least one additional engineer. Security-sensitive changes require review by a member of the security team.
• Dependency Scanning: Automated dependency scanning is performed on all builds to identify and remediate known vulnerabilities in third-party libraries and components. Critical vulnerabilities are addressed within defined SLAs.
• Static Analysis: Static application security testing (SAST) is integrated into the CI/CD pipeline to detect potential security issues before deployment.

4. Access Control

SYSTEM9 enforces strict access control measures across all systems and environments:

• Role-Based Access Control (RBAC): Access to systems and data is granted based on roles and responsibilities. Permissions are assigned according to the principle of least privilege and reviewed regularly.
• Multi-Factor Authentication (MFA): MFA is required for all employee access to production systems, internal tools, and administrative interfaces. MFA is also available and recommended for all customer accounts.
• Least Privilege: Access rights are limited to the minimum necessary for each role. Elevated privileges require explicit approval and are time-limited where possible.
• Access Reviews: Access permissions are reviewed quarterly. Access is promptly revoked upon role change or termination.

5. Data Protection

• Encryption: All customer data is encrypted at rest and in transit using industry-standard algorithms. Customers may bring their own encryption keys for additional control.
• Data Classification: SYSTEM9 supports data classification frameworks to help customers categorize and apply appropriate protections to their data based on sensitivity levels (e.g., public, internal, confidential, restricted).
• Data Loss Prevention (DLP): The platform includes mechanisms to prevent unauthorized exfiltration of data, including audit logging of all data access and transfer operations.
• Backup and Recovery: Customer data is backed up regularly with encrypted backups stored in geographically separate locations. Recovery procedures are tested periodically.

6. Incident Response

SYSTEM9 maintains a comprehensive incident response plan aligned with industry best practices. Our incident response process follows these phases:

• Detection: Continuous monitoring, alerting, and anomaly detection across all systems and networks. Security events are aggregated and correlated for rapid identification of potential incidents.
• Containment: Upon identification of a security incident, immediate steps are taken to contain the incident and prevent further impact, including isolating affected systems and preserving evidence.
• Eradication: The root cause of the incident is identified and eliminated. Affected systems are remediated and hardened to prevent recurrence.
• Recovery: Systems are restored to normal operation with validation that the incident has been fully resolved. Service restoration is verified through comprehensive testing.
• Lessons Learned: A post-incident review is conducted to identify improvements to processes, tools, and controls. Findings are documented and incorporated into the security program.

Customer Notification: SYSTEM9 will notify affected customers of confirmed security incidents within 72 hours of confirmation, in accordance with applicable data protection laws and our Data Processing Agreement.

7. Vulnerability Disclosure

SYSTEM9 operates a responsible vulnerability disclosure program. We welcome reports of security vulnerabilities from security researchers and the broader community.

If you discover a security vulnerability, please report it to:

security@system9.ai

We ask that you:

• Provide sufficient detail to reproduce and validate the vulnerability.
• Allow reasonable time for SYSTEM9 to investigate and address the vulnerability before public disclosure.
• Avoid accessing, modifying, or deleting data belonging to other users or customers.
• Act in good faith to avoid privacy violations, degradation of service, and destruction of data.

SYSTEM9 commits to acknowledging receipt of vulnerability reports within two (2) business days and providing regular status updates throughout the remediation process.

8. Compliance

SYSTEM9 maintains compliance with or is working toward the following security standards and frameworks:

• FIPS 140-3: SYSTEM9's cryptographic modules are validated to FIPS 140-3 standards, ensuring that encryption implementations meet U.S. federal government requirements.
• SOC 2 Type II: SYSTEM9 is pursuing SOC 2 Type II certification covering the Security, Availability, and Confidentiality trust service criteria. (In progress)
• ISO 27001: SYSTEM9 is working toward ISO 27001 certification for its information security management system (ISMS). (In progress)
• GDPR: SYSTEM9 processes personal data in accordance with the General Data Protection Regulation (GDPR) as described in our Data Processing Agreement.
• DFARS/NIST 800-171: SYSTEM9 supports compliance with DFARS 252.204-7012 and NIST SP 800-171 requirements for customers handling Controlled Unclassified Information (CUI).

9. Penetration Testing

SYSTEM9 engages independent third-party security firms to conduct penetration testing against the platform at least annually. Testing covers external and internal attack surfaces, including infrastructure, application, and API security. Findings are remediated based on severity, with critical findings addressed immediately. Executive summaries of penetration test results are available to customers under NDA upon request.

10. Employee Security

SYSTEM9 employees undergo the following security measures:

• Background checks are conducted for all employees with access to customer data or production systems.
• All employees complete security awareness training upon hire and annually thereafter, covering topics such as phishing, social engineering, data handling, and incident reporting.
• Employees with elevated access undergo additional role-specific security training.
• All employees sign confidentiality and acceptable use agreements as a condition of employment.
• Access to systems and data is promptly revoked upon employee departure, and off-boarding procedures include return of all company equipment and materials.

11. Contact

For questions about this Security Policy or to report a security concern, please contact us:

System9, Inc.
Security Team: security@system9.ai
General Inquiries: contact@system9.ai
Website: system9.ai