Trust Center
How we protect your data, your systems and your audits.
How we work
Security practices in every engagement.
Secure development
- Threat modelling at design time
- Peer-reviewed code and dependency scanning
- Signed builds and software bills of materials (SBOMs)
- Security testing before each release
Access and identity
- Least-privilege access to client systems
- Phishing-resistant multi-factor authentication
- Access reviewed and removed at the end of an engagement
- Separate credentials per client and environment
Data protection
- Encryption in transit and at rest
- Sensitive data classified and minimized
- Production data used only where the work requires it
- Deletion or return of data at the end of an engagement
Evidence and records
- Architecture diagrams and a control map for what we build
- Audit logging designed in, retained per your policy
- Change records your auditor can follow
- Runbooks handed over, not held back
In the Ceety Platform
Controls built in, and live today.
Every client on the Ceety Platform gets these controls. How we build compliance in
Privacy and consent
Consent is recorded with the exact words the person agreed to, where and when. Service and marketing consent are separate, and no box is ever pre-ticked.
Opt-outs are honored everywhere at once: STOP and the carriers’ standard opt-out words, unsubscribe links on every email, and a suppression list checked before every send.
Each client has a kill switch that stops all outgoing messages instantly.
Personal details are never put in web addresses. Links carry a short signed reference instead.
Social Security numbers are encrypted, only the last four digits are shown, and every full view is logged with a reason. Card numbers and SSNs are never imported from old systems.
Security and separation
Each client’s data is kept separate, and automated checks run on every change to prove it. One login belongs to one business.
Each client gets its own sending domain and its own private, encrypted file storage.
Secrets are held in an encrypted vault, never in code.
Sign-in has three layers of checks, and only staff with a role get in.
An audit trail records who did what, and it cannot be edited.
Forms are protected against bots with Cloudflare Turnstile.
Safe AI
A person approves every action the AI proposes. The AI never sends a message, approves a payment or changes a rule by itself.
The assistant spots prompt-injection attempts and flags requests for legal, tax, medical or insurance advice.
AI can be switched off per client, and there is a global kill switch. Every guardrail event is logged.
Ceety SEO follows the same pattern: the AI drafts, a person approves, the result is verified.
Automations are cautious by design. A “NO” reply to a reminder creates a task for a person; it never cancels anything.
Compliance by design
Built in, not bolted on.
One set of controls runs through everything we build. When a customer’s security review or an auditor asks, the diagrams, control map, policies and evidence already exist.
| Layer | Access | Encryption | Logging | Residency | Approval |
|---|---|---|---|---|---|
| Product | |||||
| Platforms | |||||
| AI | |||||
| Cloud | |||||
| Data |
Aligned with SOC 2, ISO 27001, HIPAA and GDPR, and with NIST AI RMF and ISO/IEC 42001 for AI.
Frameworks
What we build to.
We design controls and produce the evidence these frameworks ask for. Where a framework needs an independent audit or certification, your auditor or certification body makes that decision; we prepare you for it and work alongside them.
Security and privacy
- SOC 2
- ISO 27001
- HIPAA
- GDPR
- PCI DSS
Financial and public sector
- SOX (public companies)
- GLBA
- CJIS
- WCAG 2.1 / 2.2 AA
AI governance
- NIST AI RMF
- ISO/IEC 42001
- EU AI Act
Commitments
What we will put in writing.
- Protected health information
- We sign a Business Associate Agreement for engagements that involve protected health information.
- Data residency
- We deploy in the regions your obligations require, including the US and EU, on AWS, Azure or Google Cloud.
- Agreements
- We sign mutual non-disclosure agreements and data processing agreements. How your data is used is set out in your agreement with us.
- Security reviews
- We complete customer security questionnaires and provide supporting documentation on request.
Safe AI
AI with a person in charge.
- A person approves every action the AI proposes. It never sends a message, approves a payment or changes a rule by itself
- Approving an AI draft only opens it for a person to send
- The assistant spots prompt-injection attempts and flags requests for legal, tax, medical or insurance advice
- AI can be switched off for each client, and there is a global kill switch
- Every guardrail event is logged so it can be traced and reviewed
- Agents and tools get the least access they need, and nothing more
- Governance aligned with NIST AI RMF and ISO/IEC 42001
Report a security issue
Found a vulnerability?
Email info@ceetysystems.com with the subject “Security report”. Include what you found, how to reproduce it and how to reach you. Please give us reasonable time to fix it before sharing it publicly.
Our Privacy Policy and Terms of Service describe how this website handles personal information.
Have a security review to get through?
Send us your questionnaire or requirements and we will tell you plainly where we stand and what we can provide.