Compliance & Security

How to read this page Self-hosted

AIPrunr is software you run on your own Linux VM. This page explains how its controls support your compliance programme. It is not an audit report or a certification: Sansidera LLC does not claim SOC 2, ISO 27001, HIPAA or FedRAMP certification for AIPrunr.

Your boundary: The appliance, its database and everything it collects stay inside your network.
Read-only: It never starts, stops, creates, deletes or changes your resources, and installs nothing on them.
No vendor connection: It sends no telemetry and no data to SANSIDERA; the licence is checked offline.

SOC 2 (Trust Services Criteria) Control mapping

How AIPrunr's controls relate to the criteria your auditors will look at.

Logical access (CC6.1): All API data requires the appliance access key (minimum 32 characters, generated at setup); a separate administrator key protects exports.
Boundaries (CC6.6): The engine and a local database listen on the machine only; only the dashboard port is exposed, to your network.
Transmission (CC6.7): HTTPS dashboard with HSTS and a strict Content-Security-Policy; cloud APIs over HTTPS; database TLS configurable.
Unauthorised change (CC6.8): Read-only by design, enforced by an automated test in every release.
Monitoring (CC7.2): Request logs go to the system journal for your SIEM.
Confidentiality (C1): Cloud and datacenter credentials encrypted with AES-256-GCM; key files restricted to their owner.

GDPR & Privacy Data stays with you

SANSIDERA does not receive, access or process the data the appliance collects.

Personal data it may hold: IP addresses in network activity, and any personal data in resource names or tags.
Retention: Assets no longer found are removed after 30 days; administrators can purge older data at any time.
Erasure: Delete the data or the database; nothing is held elsewhere.
This website: When you contact us we receive your name, email and company. See our Privacy Policy.

HIPAA No health data needed

AIPrunr reads infrastructure metadata, not application data, and needs no access to patient data.

Tags and names: They are copied as they exist in your cloud, so do not put PHI in them.
Your safeguards: Because it runs in your environment, it sits inside your HIPAA-controlled infrastructure.

FedRAMP & Public Sector Inside your boundary

AIPrunr is self-hosted software, not a cloud service operated by SANSIDERA.

Assessment: Installed inside your authorization boundary, it is assessed as software within your system.
Isolated networks: A datacenter-only installation needs no internet access; cloud scanning needs HTTPS to that cloud's APIs only.

Verify It Yourself Auditable

You do not have to take our word for it.

Firewall: Allow outbound HTTPS only to the cloud APIs you use; the appliance needs nothing else.
Packet capture: Run tcpdump or Wireshark on the appliance and check every connection.
Self-audit script: From the next appliance release, the Compliance Add-on includes audit.sh, a read-only check of ports, connections, file permissions, certificate, database and services.
Technology: A Go binary, Node.js 18+ and PostgreSQL 14+ on Linux x86-64; Docker is optional.