Security & Compliance

Enterprise AI security and compliance by design

AI systems must meet the same security and compliance standards as core enterprise infrastructure. This page is also the disclosure policy named in this property's security.txt, so everything below is stated in a form you can check from outside.

What is in place on this property

Each row is a response header or cookie flag this site serves. None of it requires taking our word for it: request any page and read the headers.

ControlWhat is served
Transport security Strict-Transport-Security: max-age=31536000; includeSubDomains; preload - one year, subdomains included, submitted for preloading, so a browser refuses plaintext before the first request is made.
Content Security Policy Currently served as Content-Security-Policy-Report-Only. It is not enforcing yet: the allowlist is published in the header itself and is being observed before the switch, per property. We would rather say that than imply enforcement we have not turned on.
MIME and framing X-Content-Type-Options: nosniff and X-Frame-Options: SAMEORIGIN.
Referrer Referrer-Policy: strict-origin-when-cross-origin - the path is never sent to a third party.
Device permissions Permissions-Policy disables camera, microphone, geolocation and interest-cohort outright. This is a brochure site; none of them has a reason to be available.
Session cookie Secure; HttpOnly; SameSite=Lax. No third-party advertising cookies are set.
Version disclosure X-Powered-By and X-AspNet-Version are removed. ASP.NET emits two separate version headers by default and both are switched off.

Coordinated disclosure

A machine-readable policy is published at /.well-known/security.txt in the format defined by RFC 9116, and it names this page as the policy it points to.

This document defines a machine-parsable format ("security.txt") to help organizations describe their vulnerability disclosure practices.
RFC 9116 · IETF, April 2022

If you find a security problem here:

  • Send the details to security@slatech.co.il. Encryption is optional and supported on request. Preferred languages are English, Hebrew and Russian.
  • You will get an acknowledgement within one business day.
  • Initial triage follows within five business days, with a view on the fix timeline.
  • With your agreement we will credit you once the issue is closed.

Please do not disclose publicly before we confirm a fix. We will not pursue legal action over good-faith research carried out within the bounds of that policy. The scope covers this property, including the openly published dataset catalog under /data/: tampering or licence violation affecting dataset integrity qualifies for disclosure in the same way a site defect does.

Security foundations in the work we deliver

The controls above describe this website. The list below describes how the systems we design are built, which is a different claim and worth keeping separate.

Data isolation

Tenant separation enforced at the data layer rather than in the application, plus environment-level controls so a staging key cannot reach production records.

Access control

Role-based access, single sign-on where the client already has an identity provider, and least privilege as the default rather than an exception granted later.

Encryption

In transit and at rest, with key handling documented as part of the design rather than left to the hosting default.

Auditability

Prompts, model actions and data access are logged so an auditor can reconstruct who asked what, what the system did, and which records it touched.

Compliance alignment

  • Audit-ready architecture: operational controls, segregation of duties, a complete audit trail.
  • GDPR and data residency addressed per engagement; a data processing agreement is provided on request.
  • HIPAA-aware design for healthcare work.
  • Alignment with a client's own internal enterprise policy, which in practice is the binding one.
  • Where a framework is discussed on this site it is discussed as a design reference.

Check it without asking us

Machine-readable endpoints, each of which can be fetched and read independently:

Build AI your security team will approve

Security & compliance review