Compliance

1. Governance principles

• Least-privilege access to client systems and data
• Written scope before production changes
• Separation of client environments where architecturally required
• Vendor diligence for critical subprocessors
• Clear ownership of credentials, backups and renewals

2. Data protection

We limit collection of personal data to what is needed for delivery and support. Client data is used only for contracted purposes. Encryption in transit (TLS) is standard for public sites and APIs we control. Encryption at rest is applied where platforms and budgets support it. Access to production systems is restricted to assigned engineers and revoked when roles change.

3. Application security practices

• Secure coding baselines aligned with OWASP-oriented guidance
• Dependency and patch awareness for maintained applications
• Environment separation (dev / staging / production) when scoped
• Secrets management — no credentials committed to source control
• Optional penetration testing or audits arranged per SOW

4. Payments & billing integrity

Invoices identify services rendered, period covered and payment instructions. Payment card data is processed by PCI-aware providers; CortexSof does not store full card numbers on our systems. Multi-currency billing may be offered; FX and processor fees are disclosed when applicable.

5. AI & model usage

When AI features are part of a delivery, we document model providers, data flows and retention assumptions. Client confidential data is not used to train public models unless expressly authorized in writing. Human review checkpoints can be included for high-impact workflows.

6. Industry & regulatory projects

For fintech, healthcare-adjacent, education or other regulated work, we collaborate with Client’s compliance owners. CortexSof provides engineering controls and documentation; Client remains responsible for its regulatory filings, licenses and legal interpretations unless a separate advisory engagement is contracted.

7. Incident response

Suspected security incidents affecting Client systems we manage should be reported immediately tosupport@cortexsof.com. We will investigate, contain and communicate status updates consistent with the severity and any contractual notification windows.

8. Certifications & attestations

Marketing materials may reference partner programs or compliance frameworks we align with. Formal audit reports, certificates or SOC letters — when available — are shared under NDA upon request and should not be assumed solely from website badges.

9. Reporting a concern

Compliance or security concerns: support@cortexsof.com· +1 (727) 619-9895
CORTEXSOF LLC, 30 N Gould Ste 100, Sheridan, WY 82801, USA