Ten controls that are merged. Four gaps that are not closed.
This page is written to be checkable rather than reassuring. Everything in the first list is in the codebase today. Everything in the second is something a careful buyer would find in diligence, published here so they do not have to.
Controls in place
Each of these is enforced in code rather than described in a policy document. Where a control has a limit, the limit is in the same sentence as the control.
Residency decisions fail closed
Where a workload must run is decided before the request is made, not after. EU and UK workloads route to Bedrock in Europe, Australian workloads to Bedrock in Australia. If residency cannot be satisfied, the request does not go out — a second check at the control layer has to agree before anything leaves.
No emotion inference
The platform refuses to infer emotion from employees or from voice, and the refusal is enforced in code rather than described in a policy. This is the prohibition in Article 5(1)(f) of the EU AI Act, implemented as a routing error.
Your data does not train models
Providers that do not offer zero data retention are on a deny list, and the same commitment is written into the data processing agreement.
Tenant isolation in the database
Access rules live in the database and deny by default. A query that does not prove which tenant it belongs to returns nothing.
Per-admin identity
Every administrator has their own account. Two-factor authentication is available on every account, using time-based codes and single-use recovery codes.
Least privilege by default
A capability is off unless it has been explicitly switched on for that tenant. The check is an equality test against an explicit true, not a truthiness test.
Append-only audit trail
Privileged actions are recorded to an append-only trail. Records are added, never edited in place.
Secret scanning on every push
Every push and pull request runs a secret scan that fails the build on a hit. It is a blocking check, not an advisory one.
Nothing AI-writes is sent on its own
Every new capability is reviewed by an automated policy check and signed off by a human before it can run. Outbound messages drafted by a model wait for a person to approve them.
Structured identifiers are masked
Emails, phone numbers, government IDs, card numbers and IP addresses are masked automatically before content reaches a model. Broader entity-level redaction is in progress.
What we have not done
Every vendor has this list. Most keep it internal, which is why security pages read as marketing. Ours is here, and it is the part of this page we would check first if we were you.
Independent security review and penetration test
Scheduled, not done. No third party has tested this platform. We will publish the scope and the date when it is booked.
Security monitoring and breach alerting
The logging substrate exists. The alerting on top of it is not wired yet, so we do not claim monitoring or detection.
Entity-level PII redaction
Structured identifiers are masked today. Name, address and free-text entity redaction is in progress and is not in place.
Accessibility conformance pass on our own properties
We sell accessibility scanning, so we will not claim conformance we have not verified. The European Accessibility Act and WCAG 2.2 AA pass on cuzn.studio is scheduled and not yet complete.
Mapped to, not audited against
Our controls are mapped clause by clause to the frameworks below. That is a design exercise. It is not an attestation, and it is not a certification.
No audit has been performed and no report exists. When an independent review is booked we will publish the scope and the date, and when it completes we will say what it found — including if it finds something bad.
- SOC 2
- ISO 27001
- HIPAA
- GDPR
- PCI-DSS
- OWASP ASVS
If your procurement process needs a specific control evidenced, ask. We will show you the code path or tell you it does not exist yet. Those are the only two answers available.
The questions buyers actually ask
Does CUZN train AI models on my data?
No. Providers that do not offer zero data retention are on a deny list in the routing layer, and the same commitment is written into our data processing agreement.
Where is my data stored?
Where you require it to be. EU and UK workloads route to Bedrock in Europe and Australian workloads to Bedrock in Australia. If a request cannot satisfy its residency rule, it is refused rather than sent somewhere else.
Is CUZN SOC 2 certified?
No. No audit has been performed and no report exists. Our controls are mapped to SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS and OWASP ASVS clauses, which is a design exercise rather than an attestation. An independent review is scheduled and we will say so plainly when it is complete.
Can CUZN handle healthcare data?
The platform is architected for HIPAA workloads — residency routing, per-admin identity, least privilege and an append-only audit trail. We do not currently sign business associate agreements, and we will tell you that before you ask rather than after.
What happens if the AI gets something wrong?
Nothing a model produces is sent or actioned on its own. Drafts wait for a person. Where a model classifies something, the classification is recorded with the input that produced it, so a wrong answer can be traced rather than guessed at.
Found something?
Report it to [email protected]. We will acknowledge it, and we will not threaten you for looking. Abuse of a service we host goes to the abuse form instead.
Run the scanner on yourself first.
The same engine that produces our compliance findings will run against your domain for free. It is the fastest way to judge whether we know what we are talking about.