Chronotope Labs, Inc.
Security and Customer Data Protection
1. Scope and responsibility
Chronotope's security program covers company systems and the confidential information used in our computational modeling, AI development, simulations, digital twins, software, and industrial data work. This page summarizes the requirements of that program. Details of implemented controls for a specific engagement are addressed through project documentation and customer security reviews; this page is not an independent audit report.
The Chief Executive Officer is accountable for the program and assigns technical and project responsibilities to appropriate personnel. Our governance requirements include policy review at least annually and after material changes, documented risk decisions, and tracking of corrective actions. We use Vanta to support security and compliance management. Use of a compliance platform is not evidence of a completed SOC 2 examination or other independent certification.
2. Customer confidentiality and permitted use
Customer data and confidential project materials must be treated as Confidential and accessed only for authorized work. Personnel and contractors with access must be subject to appropriate confidentiality obligations. Sharing is restricted to authorized project personnel, approved providers, and other recipients permitted by the applicable agreement and law.
Customer-specific datasets, repositories, models, credentials, and results must be separated through appropriate access and project controls. The required level of infrastructure isolation is defined for the engagement; a shared provider does not authorize cross-customer access or reuse. Public repositories, public links, and external demonstrations must not expose customer confidential information without express authorization.
Our Privacy Policy's restrictions on cross-customer reuse, external AI tools, model training, and dataset licensing also apply to confidential industrial information that is not personal information. Applicable customer ownership and intellectual-property commitments remain controlling. This page grants no additional rights to Chronotope.
3. Deployment and industrial environments
Project requirements must identify authorized hosting and storage locations, permitted remote access, data flows, providers, and responsibilities for operation and recovery. Deployment may be in an agreed cloud environment or on customer-controlled infrastructure. Offline or on-premises requirements must not be bypassed by transferring data to an external cloud or AI service.
Cloud providers, Chronotope, and customers have distinct responsibilities for their respective systems; these responsibilities must be documented. Customer-managed equipment and networks remain subject to the access and change permissions agreed for the project.
Access to a plant, mine, industrial network, diagnostic port, camera, or sensor does not authorize changes to operational equipment. Personnel must follow site rules and use only the interfaces, collection methods, and activities approved for the engagement. Control-system integration, changes to operating parameters, and autonomous actions require express scope, validation, and customer authorization. Safety controls must not be bypassed.
4. Identity and access
Our access-control standard requires individual accounts for personnel, approved access based on business need, and limited administrative privileges. Multifactor authentication is required for privileged production access and for company systems supporting it. Systems unable to support required authentication need a documented risk assessment and appropriate alternative safeguards before handling confidential information.
Service accounts must have an owner, an authorized purpose, and permissions limited to that purpose. Credentials and secrets must be protected and must not be committed to source repositories or placed in public documents or unapproved tools.
Access must be reviewed at least annually and when responsibilities change, with prompt removal when no longer needed. Offboarding must address user accounts, active sessions, keys, tokens, provider access, and returned devices. Suspected compromise requires immediate containment appropriate to the risk. Internal administrative deadlines do not authorize continued unnecessary access.
5. Encryption and devices
Our data-protection standard requires encryption of confidential information in transit and at rest on approved systems. Personnel must use authenticated, access-controlled transfer methods; ordinary public links and unapproved removable media must not be used for confidential project data. Encryption settings, key responsibilities, and any legacy equipment limitations must be considered in the project design.
Devices used for confidential work must meet company security requirements, including authenticated access, disk encryption where data is stored, automatic screen locking, supported software, security updates, and appropriate malware protection. Device and access records must support accountability. Confidential information must be securely removed before equipment is reassigned or disposed of.
Office, remote, travel, and customer-site work must protect devices and information against unauthorized viewing, access, loss, and theft. Visitors must be authorized and must not receive access to restricted work areas or confidential materials without permission and appropriate supervision.
6. Development and changes
Our development requirements include version control, restricted repository access, separation of development and production access, and protection of customer data used for testing. Synthetic or appropriately de-identified test data should be used where suitable; use of confidential production data in another environment requires authorization and equivalent safeguards.
Production changes must be tested and reviewed by an authorized person other than the author before release, with approval and release records retained. Model releases must be evaluated against their intended use, data limitations, and agreed acceptance criteria. A successful software release does not itself authorize a change to physical operating conditions.
Security issues, vulnerable dependencies, and required patches must be assessed and prioritized by risk, tracked to resolution, and escalated where necessary. A known critical exposure requires prompt risk reduction; a remediation exception must be documented, approved, time-limited, and consistent with customer and legal obligations.
7. Monitoring and incident handling
Relevant systems must retain appropriate access, administrative, and security records. Logging and alerting responsibilities must be assigned, including review and escalation of suspicious activity. Logs must be protected against unauthorized access and must avoid unnecessary recording of sensitive information or secrets.
Personnel must promptly report suspected loss, unauthorized disclosure, credential compromise, malicious activity, or material service disruption. Incident procedures must cover assessment, containment, evidence preservation, investigation, recovery, and corrective action, with designated decision-makers and communication responsibilities.
Where an incident affects customer information or services, notification must follow the applicable agreement and law, without undue delay where required. Required notices must not be postponed merely until an investigation is complete. Incident-specific facts may be supplemented as the investigation progresses. No universal notification deadline or round-the-clock monitoring service is promised by this website page.
8. Continuity and data return
Continuity and recovery arrangements must reflect the data, systems, and responsibilities of the engagement. Where Chronotope is responsible for recoverable project records or services, those arrangements must identify backup scope, protection, retention, responsible personnel, and restoration procedures. Recovery capability must be checked at a frequency appropriate to risk and contractual requirements.
Specific availability, recovery-time, recovery-point, support, and retention commitments must be stated in the applicable agreement. On completion or termination, authorized personnel must follow the agreed data-return, deletion, and access-removal process, including relevant derived artifacts and provider copies. Any legally permitted retained records remain subject to confidentiality and use restrictions.
9. Providers and personnel
Cloud platforms, software services, external AI providers, consultants, and subcontractors can introduce security or privacy risks. Providers with access to confidential information must undergo a proportionate review before access is granted. Review must consider the information involved, permissions, locations, contractual protections, incident obligations, and any customer approval requirements.
Relevant providers must be reassessed at least annually and following material changes or significant incidents. Provider use must be recorded. Discovery of an application or possession of its security report does not itself constitute approval, and a provider's certification does not certify Chronotope.
Personnel must acknowledge applicable policies and complete security-awareness training at onboarding and annually thereafter. Additional guidance must address their access and responsibilities, including industrial confidentiality, phishing, credentials, AI tools, and reporting incidents. Policy acceptance, assigned training, completed training, and operating evidence must be recorded accurately as distinct events.
10. Security inquiries
Customers may request relevant security documentation and available assurance materials through their project contact or [email protected], subject to confidentiality and appropriate access restrictions. Any assessment or assurance statement must identify the systems, period, and scope actually covered.
Report a suspected vulnerability or incident to [email protected]. Describe the affected service and issue without transmitting passwords, confidential datasets, or unnecessary personal information. We will arrange a suitable channel where sensitive details are needed.
Customer-specific agreements and mandatory legal requirements continue to apply. Updating this page does not remove existing contractual commitments or replace the need to implement and verify the controls required for an engagement.
Contact:
Chronotope Labs, Inc.
[email protected]