Trust & Security
3cubed.ai builds and hosts AI-powered products for clients in regulated industries. Our clients trust us with sensitive systems and data, and we engineer our operations accordingly. This page summarizes our security posture.
For detailed security documentation, including our SOC 2 Type II report when available, security questionnaire responses, and architecture details, please contact info@3cubed.ai. We share these materials with prospective and current clients under a mutual NDA.
Compliance & Attestations
Our compliance program is designed around independent review, continuous monitoring, and client-specific documentation.
-
SOC 2 Type II
In progress. 3cubed.ai is currently undergoing a SOC 2 Type II audit covering the Security trust services criterion. Our compliance program is managed in Vanta, with continuous monitoring of access, configuration, and operational controls. The Type II report will be available to clients under NDA upon completion.
-
Aligned frameworks
Our control program is also aligned with relevant aspects of GDPR, ISO 27001, and HIPAA for clients whose use cases require it.
Infrastructure
Client products are hosted on cloud infrastructure with isolated project boundaries and configurable residency options.
-
Cloud platform
All client-hosted products run on Google Cloud Platform (GCP) in dedicated, segregated projects. We do not operate physical data centers; GCP holds SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, and FedRAMP High attestations.
-
Project isolation
Each client product runs in its own GCP project with independent IAM, networking, and logging boundaries. We do not co-mingle client data across projects.
-
Region and residency
Default region is U.S.-multi-region. Region selection can be tailored at the client level for residency requirements, including EU, Canada, and Asia-Pacific.
Encryption
Data is protected in transit and at rest using modern encryption standards and managed key infrastructure.
-
In transit
All data transmitted to or from client products is encrypted using TLS 1.2 or higher.
-
At rest
All persistent customer data is encrypted at rest using AES-256, with keys managed by Google Cloud KMS. Customer-managed encryption keys (CMEK) are available on request.
Access Control
Access to production and administrative systems is limited, reviewed, and tied to centralized identity controls.
-
Least privilege
Production access is restricted to a minimal set of authorized personnel. Roles are granted on a need-to-have basis and reviewed quarterly.
-
Multi-factor authentication
MFA is enforced on all 3cubed.ai workforce accounts through Google Workspace identity provider and all administrative access to GCP and source-control systems.
-
Workload identity federation
Production systems authenticate to GCP using workload-identity federation. We do not use long-lived service-account keys for production workflows.
-
Single sign-on
Internal systems are accessed via Google Workspace SSO. Access is automatically revoked on workforce offboarding.
Software Development
Our software development process includes protected source control, dependency monitoring, controlled deployment, and container scanning.
-
Source control
All code is managed in private GitHub repositories with branch protection, required code review, and signed commits.
-
Dependency management
Dependencies are continuously monitored for known vulnerabilities through Dependabot. Critical and high-severity findings are remediated under defined SLAs.
-
Change management
Changes to production are deployed through automated CI/CD pipelines with separation between code authors and deployers.
-
Container scanning
Container images deployed to GCP are scanned for known vulnerabilities via Container Analysis prior to deployment.
Monitoring & Incident Response
Monitoring and incident-response practices are designed to detect issues early and support clear client communications.
-
Continuous monitoring
Production environments emit centralized audit logs. Suspicious activity, configuration drift, and policy violations are detected through automated controls.
-
Incident response
We maintain a documented incident-response plan covering detection, containment, eradication, recovery, and post-incident review. Affected clients are notified consistent with our contractual commitments and applicable law.
-
Vulnerability management
We perform an annual third-party penetration test of in-scope production systems. Findings are tracked to remediation with severity-based SLAs.
Vendor Management
We use a small set of vendors to deliver our services. All vendors are vetted for security and contractual fit before onboarding.
We maintain a public list of subprocessors that may process client data on our behalf. See: Subprocessors.
Business Continuity & Backups
Backup and recovery practices are built around native GCP capabilities and tested operational procedures.
-
Backups
Customer data is backed up automatically through native GCP services with point-in-time recovery where supported by the underlying database.
-
Disaster recovery
We test our disaster-recovery procedures at least annually through tabletop exercises and documented runbooks.
Reporting a Security Concern
If you believe you have discovered a security issue affecting 3cubed.ai or a system we operate, please contact us promptly.
Email info@3cubed.ai. We commit to acknowledging valid reports within two business days. We do not currently operate a public bug-bounty program.
Documentation Available Under NDA
The following materials are available to current and prospective clients under a mutual NDA.
-
SOC 2 Type II report
Available when complete.
-
Penetration test executive summary
Available for applicable in-scope production systems.
-
Security questionnaire responses
CAIQ, SIG-Lite, and custom questionnaire responses.
-
Architecture and data-flow diagrams
Provided for the specific product under evaluation.
-
Subprocessor agreements
Available for review where appropriate under NDA.
To request materials, email info@3cubed.ai with your company name, the materials you need, and any deadline.