Security Overview

Encryption. We encrypt Customer Data in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent encryption standards.

Access Control. We enforce logical isolation of customer data, role-based access controls, and least-privilege principles across all systems.

Authentication. Multi-factor authentication (MFA) is available on all plans. Single sign-on (SSO) is available on the Enterprise plan.

Backups. Intempt takes daily backups of Customer Data, retains each for seven (7) days and then deletes it as part of Intempt's standard data lifecycle procedures. Intempt also maintains data redundancy and infrastructure resilience controls appropriate to the Services; where infrastructure-level copies of data exist, they are encrypted and isolated from active processing.

Monitoring. Intempt monitors its production infrastructure 24/7/365. Logs and metrics are centralized in Grafana, and alerts page a dedicated DevOps/SRE team on call around the clock through Better Stack.

Secure Development. We follow a secure software development lifecycle (SDLC) that includes security reviews, dependency scanning, infrastructure hardening, and testing against the OWASP Top 10.

Incident Response. The same DevOps/SRE team is Intempt's incident response team, following a defined process for escalation, containment, and remediation. Any security incident affecting a customer's account, or suspected loss or corruption of Customer Data, is treated as Severity 1 under the Service Level Agreement. In the event of a confirmed security incident involving Customer Data, we will notify affected customers within seventy-two (72) hours of confirmation, followed by a formal root cause analysis (RCA) and remediation plan.

AI Data Protection. Intempt trains per-customer AI models exclusively within each customer's logically isolated tenant environment. Customer data is never used to train models serving other customers. Third-party AI subprocessors (OpenAI, Anthropic and Google Gemini) are prohibited under commercial API terms from using Customer Data to train their own models.

Email Security. Intempt uses Google Workspace with enhanced security features for internal communications, including inbound email screening and attachment controls.

Continuous application scanning. Every pull request across our repositories is automatically scanned before it can merge: static analysis of our own code (SAST), known-vulnerable and malicious open-source dependencies (SCA), and any secret or key accidentally committed. Critical and high findings carry defined remediation timelines and are tracked to closure.

Cloud and container posture. Our production cloud account is monitored continuously for misconfiguration (cloud security posture management). Infrastructure-as-code and container images are scanned for insecure settings, and our Kubernetes cluster runs an in-cluster agent that scans running workloads and the images behind them.

Source and supply-chain security. Code is hosted in GitHub with branch protection and mandatory review. Production branches cannot be force-pushed and move only by a controlled promotion. Build dependencies and CI actions are tracked and pinned to reduce supply-chain risk.

Dynamic and manual testing. We run automated dynamic application security testing (DAST) against our public surface and internal penetration testing against the OWASP Top 10. Confirmed findings are triaged by severity and tracked to closure. A third-party penetration test is part of our SOC 2 Type II program.

AI Model Security. Customer AI models are trained and stored within logically isolated per-customer environments. Access is restricted to authorized Intempt engineering personnel under least-privilege controls. Training pipelines are subject to Intempt's SDLC security review. Customer AI models are deleted within thirty (30) days of subscription termination.

Compliance. Intempt is preparing for SOC 2 Type II, including a third-party penetration test.

Intempt considers security research conducted in good faith and in line with this policy to be authorized. If you follow the scope and rules in this policy, we will not initiate or support legal action against you for your research. We will not pursue claims under the Computer Fraud and Abuse Act, the DMCA, or similar laws, and we will not claim your research breaks our Terms of Service. If a third party takes legal action against you for research done under this policy, we will say that your actions were authorized.

This protection applies only to in-scope assets and only if you follow the rules: test only accounts and projects you own, use the sandbox tenants we provide for cross-tenant and PII proofs, stop at proof, do not access or keep real customer data, and give us reasonable time to fix an issue before disclosing it. It does not cover out-of-scope systems, denial-of-service testing, social engineering, or physical attacks. We will work with you on the timing of any public disclosure.