The defences, the audit trail, and the email that finds a human within an hour.
What follows is the security posture of cmintel.ai and the COLOSSEUM operator stack behind it. Each section is one paragraph in plain English. If anything is missing or unclear, the disclosure mailbox below answers within one business hour during UK working time.
1. Encryption
All traffic to cmintel.ai is TLS 1.3, with HSTS preload enabled. At rest, customer data in Supabase is AES-256-encrypted at the disk level by AWS RDS; objects in Cloudflare R2 are encrypted with AES-256 GCM; D1 storage is encrypted at the Cloudflare edge. Form submissions are validated client-side with cryptographic checksums where it adds value (large uploads); short payloads use straight TLS without additional layering, because adding layering would obscure the simple truth that TLS 1.3 is sufficient at the byte sizes we handle.
2. Access control
Every human account that can reach customer data uses multi-factor authentication. We follow least-privilege: an operator's account holds the minimum scopes needed for the work that operator does, no more. Access is reviewed quarterly. Every access change is recorded in an audit log retained for 24 months. There is no shared admin account; we do not have one and would not create one.
3. Vulnerability management
Automated dependency scanning (GitHub Dependabot) and static code scanning are not yet switched on; we are adding both before our first paying customer. We run a quarterly internal penetration test against the trust-spine routes and the operator dashboard. We have not yet had a third-party penetration test. We will commission an independent third-party penetration test of the production API before our first paying customer, and publish a summary of its findings here. Findings of severity P1 or P2 will be disclosed at /api/status within 14 days of remediation.
4. Incident response
Our commitment is 24-hour notification to affected customers and 72-hour notification to the regulator (UK ICO, EDPB lead supervisory authority pending). The incident-response runbook is the single place we coordinate from during an incident, and incident write-ups are public at /api/status with severity, cause, and remediation. We name the cause; we do not weasel-word it.
5. Security monitoring
Cloudflare bot management runs at the edge; rate-limits are applied per IP and per email; structured application logs ship to a hardened Sentry instance with PII scrubbed before the request leaves the browser. We do not log request bodies for the contact or DSAR endpoints — only metadata. We do log every change to the audit-log schema, recursively.
6. Vendor security
Every third party that processes data on our behalf is listed at /trust, with the country of operation, the data categories, and a link to its Data Processing Addendum where one is published. We are completing a signed DPA with every vendor on that list, and each row shows its DPA status. We review the list every quarter. If you find a vendor on our site that is not on /trust, that is a bug — please email trust@cmintel.ai.
7. Disclosure
Mail security@cmintel.ai for any vulnerability, near-miss, or anomaly. We respond within one business hour during UK working time (Monday–Friday, 09:00–18:00 BST). The mailbox is monitored by a human, not a triage robot. The PGP key to encrypt your disclosure is at /.well-known/pgp-key.txt; the signed security.txt is at /.well-known/security.txt.
PGP fingerprint: 7D51 528C B807 D5C0 4E27 CD47 B516 A329 A29F 98F0 (RSA-4096, valid to 2029-06). Verify the key you download against this fingerprint before trusting it.
Last updated 2026-10-20