This page exists so an InfoSec reviewer handed this URL by procurement can read our posture end to end, without scheduling a sales call first. It is a written statement of how Plumbline AIprotects evaluation records — not a brochure, not a marketecture. Where we are still mid-program, we say so plainly.
Every API call sits behind TLS 1.3; no plaintext ingress or egress is supported on the write path. Evaluation records at rest are protected by AES-256 in the ledger substrate, with the signing key anchored to the buyer's KMS rather than to the production write path. Bytea-level redaction is applied to PHI fields before chain linkage, so the auditor sees provenance without ever reading the underlying payload.
Keys are rotated on a published cadence; rotation events are themselves records in the chain, so a re-key never breaks continuity of the evidence trail.
Role-based access control applies at both write and read. The write path enforces a schema-level RBAC check on every record; the read path enforces an attribute-based filter on top of the chain role. Auditor-only fields (raw inputs, annotations, incident comments) ship default-deny — they are present in the record but invisible until a role explicitly grants visibility.
The examiner-read-only role is what PI-grade teams use: it can walk the chain from any signed record back to its inputs and scorer output, but cannot write, delete, or re-tag. PI tagging happens at write time, scoped by access role, so PHI never lands in a record a non-PI reader can open.
Retention is configured at write time, scoped to the regulatory window the record falls under. The defaults are sized to the programs our buyers actually run: seven years for SOX-aligned change records, six years for HIPAA-adjacent clinical-evidence workflows, and the NIST AI RMF window sized to the model's published risk profile (typically three to five years for non-high-risk systems, longer for high-risk designations).
The retention policy itself is a record in the chain. When the auditor asks “how long was this scorekeeper set to keep these records,” the policy under which the answer is true sits in the same hash chain as the records it captures.
At cancellation we hand off an export bundle in the format the buyer's DPA names (raw records plus the chain, plus a signed verification manifest). Production-side hard-deletion runs on a published schedule after handoff; backup-side deletion runs on the backup rotation schedule after that, with both events written into the same chain the records lived on.
The deletion timeline, the handoff format, and the verification manifest are all written into the DPA at signature, so the auditor can read the answer there without having to ask. Cancellation is a record, not a silent event.
We use four categories of sub-processor: managed-hosting providers, transactional email, payment processing, and observability tooling. The current vendor list under each category is the buyer's on request under NDA — vendor names do not live on this page, because the program is mid-buildout and the list can shift quarter to quarter without affecting the buyer's data posture.
Sub-processor changes are announced in writing on a published notice window before taking effect, so the buyer has time to object before a new vendor sees their chain data. The full list, the data each category handles, and the residency of each are in the DPA.
SOC 2 Type II is in progress. We will share the bridge letter on request once the observation window closes; the auditor's name and the report type are listed in the DPA at signature. Read this as a roadmap line, not a “we are certified” claim — the program ends when the report issues, and we will say so on this page when it does.
HIPAA posture is delivered via a signed BAA on the enterprise tier, with the access-control and retention defaults in §2 and §3 sized to the BAA's PHI provisions. GDPR posture is delivered via a DPA, an EU-representative path, and a documented data-residency option that lets the buyer pin records to a specific region. The buy-side record of all three is the DPA itself.