Trust Center
PHINET LLC is a small, senior-led security consultancy. This page shows how we protect your data, what is in place today, and what is still in progress. We don't claim anything we haven't checked, and each item shows when it was last verified.
17 in place 6 in progress 0 planned · Last updated 2026-11-11
Certifications
PHINET does not hold SOC 2, ISO 27001 or other third-party certifications. We help clients prepare for them, and we'll list any we earn here.
Engagements and legal
| Control | Status | Verified |
|---|---|---|
| No testing without paperwork Every test needs a signed MSA, Statement of Work and Rules of Engagement that define scope, timing and contacts. | In place | 2026-11-11 |
| Human-verified findings AI helps with analysis; a qualified person reviews every finding and report statement before release. | In place | 2026-11-11 |
| Contracts reviewed by an attorney Our MSA, SOW, NDA and policies are drafted; attorney review is scheduled. | In progress | 2026-11-11 |
| Professional and cyber liability insurance Quotes requested for errors and omissions and cyber liability cover. | In progress | 2026-11-11 |
Data handling
| Control | Status | Verified |
|---|---|---|
| Data classes Restricted (credentials, keys, personal or health data found during testing), Confidential (findings, configs, code) and Internal. Each class has its own handling rules. | In place | 2026-11-11 |
| Minimal collection We prove impact without copying bulk data. Restricted data is never kept beyond minimal proof and is redacted in reports. | In place | 2026-11-11 |
| Retention and deletion Client engagement data is deleted 90 days after final delivery, and each deletion is logged. Contracts and invoices are kept for 7 years. | In place | 2026-11-11 |
| Secure report delivery Reports go only through encrypted channels; passwords are sent separately. | In place | 2026-11-11 |
| Breach notification Suspected exposure of client data is reported to you within 72 hours of discovery, or sooner if law or contract requires. | In place | 2026-11-11 |
AI use
| Control | Status | Verified |
|---|---|---|
| Approved AI tools only Claude Code under PHINET's own plan, plus local open-source tools. No other AI service receives client data. | In place | 2026-11-11 |
| Sensitive data never goes to AI Credentials, keys and personal data are redacted before any AI processing. | In place | 2026-11-11 |
| Opt out of AI You can opt out of AI-assisted processing in your Statement of Work. | In place | 2026-11-11 |
| Automation can't act on its own Our automated assistants can only draft. Sending, signing, paying and sharing identifiers are blocked by tool permissions, not by instructions alone. | In place | 2026-11-11 |
Infrastructure
| Control | Status | Verified |
|---|---|---|
| Encrypted laptop Full-disk encryption (FileVault) on the work Mac. | In place | 2026-11-11 |
| Host firewall The macOS firewall is being enabled on the work Mac. | In progress | 2026-11-11 |
| Secrets in a vault API keys and passwords live only in the macOS Keychain, never in files or code. | In place | 2026-11-11 |
| Segmented management network Remote-management devices and hypervisor access are moving to an isolated management network reachable only over VPN. | In progress | 2026-11-11 |
| Vetted third-party tools New tools and code libraries are reviewed and scored for security, and checked for known vulnerabilities, before we install them. | In place | 2026-11-11 |
Website and domain
| Control | Status | Verified |
|---|---|---|
| Modern TLS only HTTPS everywhere, TLS 1.2 or newer, Full (strict) origin validation, HSTS. | In place | 2026-11-11 |
| DNSSEC phinets.com is signed with DNSSEC. | In place | 2026-11-11 |
| No tracking This site uses no cookies, analytics, ad trackers, third-party fonts or JavaScript, and a strict Content Security Policy. | In place | 2026-11-11 |
| Certificate authority restrictions (CAA) We're adding CAA records so that only our chosen certificate authorities can issue certificates for phinets.com. | In progress | 2026-11-11 |
| Email authentication DMARC is published in monitoring mode, and will be tightened to quarantine after the review period. | In progress | 2026-11-11 |
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, DNS, email routing, DDoS protection | Global (US company) |
| Anthropic, PBC | AI assistance (Claude Code) for analysis and drafting; sensitive data is redacted first; you can opt out | US |
| Yahoo Inc. | Email mailbox for forwarded mail, until we move to Microsoft 365 | US |
Documents on request
Available under NDA. Email support@phinets.com.
- Master Services Agreement
- Statement of Work template
- Mutual NDA
- Rules of Engagement
- AI and Data Handling Policy
Report a vulnerability
Email support@phinets.com. See our security.txt. Please include enough detail to reproduce the issue, and don't access more data than you need to show it.