Back to home Trust

Security at Iris

Last updated: July 23, 2026

Our commitment

Iris acts on some of the most personal data there is — your email, calendar, messages, and voice. Protecting it is a design constraint, not an afterthought. This page describes the technical and organizational measures we operate today. Questions or reports: security@meetiris.com.

Compliance program

  • SOC 2 Type I: an independent examination of our controls is in progress (audit period July–August 2026, conducted by an independent CPA firm). Report available to customers under NDA once issued.
  • Policy framework: a full information-security policy set (access control, cryptography, incident response, secure development, vendor management, and more) is approved, in force, and reviewed annually.
  • Risk management: we maintain a formal risk register with assessed, owned, and mitigated risks, reviewed on a recurring cycle.
  • Privacy: our practices are GDPR- and CCPA-aligned — see the Privacy Policy. We do not sell personal data.

Encryption

  • In transit: all traffic to and between our services uses TLS 1.2+; HTTP Strict Transport Security is enforced at the API edge.
  • At rest: the production database runs on an encrypted volume (LUKS2, AES); cloud object storage uses provider-managed AES-256 encryption; storage buckets have public-access prevention enforced at the platform level.
  • Devices: company endpoints enforce full-disk encryption (FileVault).

Infrastructure

  • Hosting: production workloads run on Hetzner Cloud (ISO 27001 certified data centers); the website is hosted on Vercel; identity and supporting services run on Google Cloud / Firebase.
  • Network: cloud firewalls default-deny inbound traffic; databases are bound to localhost and never exposed publicly; TLS terminates at a hardened reverse proxy with modern security headers.
  • Isolation: AI-agent tasks execute in rootless, sandboxed containers with an egress allowlist — agent code cannot reach arbitrary network destinations.
  • Monitoring: infrastructure metrics, alerting, uptime monitoring of public endpoints, and centralized logs operate around the clock.

Access control

  • Least privilege: access to production systems and data is restricted to the small engineering team and granted per system; service accounts carry minimum necessary permissions.
  • Authentication: multi-factor authentication protects our collaboration and code platforms; SSH to production requires key-based authentication.
  • Reviews: access is reviewed on a recurring cycle with documented provisioning and deprovisioning; departed collaborators are removed promptly.

Secure development

  • Change control: every production change ships through a pull request and an automated CI gate (type checks and a test suite of several thousand tests) before deployment.
  • Dependency security: continuous automated vulnerability scanning across our repositories, with defined remediation SLAs — critical findings within 7 days, high within 14; in practice, recent critical advisories were patched and deployed the same day.
  • Testing: internal penetration testing of the backend and public surface, plus continuous external attack-surface scanning; findings are tracked as prioritized tickets to closure.

AI-specific safeguards

  • Model routing: requests to third-party AI model providers are routed with the minimum context needed to fulfill your request; your content is not used to train models (see Privacy Policy §5).
  • Payment & action safety: sensitive actions carry explicit confirmation gates (for example, purchases require biometric confirmation in the app).
  • Sandboxing: autonomous agent code runs inside isolated containers with restricted network egress, separated from production data stores.

Vendors

We use a small set of vetted subprocessors (hosting, AI inference, telephony — full list in the Privacy Policy). Each completed vendor security due diligence; our core providers publish SOC 2 and/or ISO 27001 attestations, and data-processing agreements are in place.

Incident response & disclosure

  • Incident response: a documented incident-response plan defines roles, severity levels, and communication duties, including notifying affected users where required by law.
  • Responsible disclosure: if you believe you have found a security vulnerability in Iris, please email security@meetiris.com. We review every report, will acknowledge yours promptly, and ask that you give us reasonable time to remediate before public disclosure. We do not pursue legal action against good-faith research.

Contact

security@meetiris.com · Iris Assistant, Inc., 28 W Flagler St, Ste 300B, Miami, FL 33130, USA