Trust & compliance
Trust & Security
How we handle your data, what security controls we have in place, and our commitments to uptime, privacy, and compliance.
TLS 1.3
Encryption in transit
Live
Health endpoint
GDPR
Compliant
SOC 2
Audit in progress
Security Controls
enforced
- All data in transit encrypted via TLS 1.3
- Data at rest encrypted using AES-256
- API keys hashed with bcrypt — never stored in plaintext
- Infrastructure isolated per-tenant; no cross-customer data access
- Regular third-party penetration testing
- Dependency scanning via Dependabot + Snyk on every PR
- Principle of least privilege across all internal systems
Uptime & Reliability
99.9 % SLA
- Internal target of 99.9% monthly uptime for the threat intelligence API — an objective, not a contractual SLA, and not yet independently measured
- Real-time status page at ismalicious.com/status
- Automated alerting on p95 latency > 500ms
- Global CDN edge caching on verdict responses (TTL configurable)
- Redundant PostgreSQL with automated failover
- Redis cluster for rate limiting and session data
- Incident response within 1 hour for P0 issues
Data Retention
90-day logs
- API request logs retained for 90 days, then automatically purged
- Threat intelligence data refreshed continuously — no stale verdicts older than 24h for active indicators
- Account data deleted within 30 days of account closure upon request
- No user query data sold or shared with third parties
- Bulk export data does not include any customer-identifiable metadata
- Indicators of compromise (IOCs) sourced from public and licensed feeds — no user-submitted data in verdicts
Privacy & Compliance
GDPR · CCPA
- GDPR Article 17 (right to erasure) honored within 72 hours
- CCPA opt-out respected — no sale of personal information
- Cookie consent banner with granular controls on all marketing pages
- Privacy policy and DPA (Data Processing Agreement) available on request
- No third-party advertising trackers on authenticated dashboard pages
- Sub-processors disclosed in our Privacy Policy
SOC 2 Roadmap
audit in progress
- SOC 2 Type I audit in progress — expected completion Q3 2026
- Controls mapped to AICPA Trust Services Criteria (Security, Availability, Confidentiality)
- Audit conducted by an AICPA-accredited firm
- SOC 2 Type II audit planned for Q1 2027
- Enterprise customers can request a copy of the audit report under NDA upon completion
Responsible Disclosure
If you discover a security vulnerability in isMalicious, please report it to security@ismalicious.com. We follow a 90-day coordinated disclosure timeline and acknowledge valid reports within 48 hours.
Data Processing Agreement
Enterprise customers can request a signed DPA for GDPR compliance purposes. Contact us with your organization details.
Last reviewed: 2026-04