Security Policy

1. Encryption

• Data in transit encrypted with TLS 1.2+ (TLS 1.3 preferred).
• Data at rest encrypted with AES-256.
• Secrets and credentials stored in managed secret vaults, never in source code.

2. Access Control

• Role-based access with least privilege.
• Multi-factor authentication for all internal administrative access.
• Client data isolated per tenant with row-level access controls.
• Audit logging of administrative actions.

3. SOC 2 Alignment

Our controls are designed to align with the SOC 2 Trust Services Criteria (security, availability and confidentiality). We are not yet SOC 2 certified; a formal audit is on our roadmap.

4. AI-Specific Safeguards

• Prompt-injection and jailbreak testing before every launch.
• Output filtering and topic restrictions.
• Input validation and sanitization on all channels.

5. Vulnerability Disclosure Program

We welcome reports from security researchers. Email security findings to support@gringoservice.com with the subject "Security Disclosure". Please give us reasonable time to remediate before public disclosure and avoid accessing data that isn't yours. We will not pursue legal action against good-faith research.