Trust Center Changelog

Clarified that Security Hub is a platform-operations tool and distinguished web token lifetimes from the extension session cap.

Scoped field encryption, AI context and cookie descriptions to the relevant workflows.

Replaced cloud, network, staff-training, backup and incident-history statements we could not verify with our policy targets and details of what you can request.

Corrected scoped decrypted-intake access, key migration, account-retention and Gio case-cleanup descriptions.

Disclosed marketing-site Meta Pixel and raw document-recognition processing separately from case-context redaction.

Removed statements we could not support — that all controls were verified, that independent testing had taken place, and about HIPAA — and separated policy targets from completed assessments.

Compliance page — SOC 2 Trust Service Criteria status updated from 'In Scope' to 'Implemented' with detailed control descriptions for all 9 categories

Compliance roadmap — SOC 2 Type II milestone updated to reflect all controls implemented, audit engagement in progress

Data export audit-logging documentation updated; coverage and tamper-evidence depend on the export workflow

Documented enhancement areas include password policy configuration, vulnerability scanning and session timeout enforcement; ask us for their current status

AI Security & Governance page (/trust/ai-security) — data handling, controls, prompt injection protection

Business Continuity & DR page (/trust/business-continuity) — RPO/RTO targets, backup strategy, DR testing program

Employee & Operational Security page (/trust/employee-security) — staff controls, training program, offboarding procedures

Network Security page (/trust/network-security) — WAF, DDoS mitigation, rate limits, HTTP security headers

Trust Hub — posture scorecard with 9 domains, key stats, grouped navigation, core data commitments

Security page — HTTP security headers table and clean security incident history section

Infrastructure page — anonymized vendor names, improved backup & DR detail with cross-links

Compliance page — visual compliance roadmap timeline (GDPR → IRS 4557 → CCPA → SOC 2 Q3 2026 → ISO 27001 2027)

Subprocessors page — grouped by category, data sensitivity levels (High/Medium/Low), summary stats

Subprocessors — added a data-sensitivity level to all 9 vendor entries

Full Trust Center at /trust/* with 15 structured pages

Dedicated Security, Privacy, Compliance, Infrastructure, and Access Control pages

Subprocessors page with vendor table (8 vendors listed)

Data Protection and Data Retention pages with structured tables

Incident Response page with P0–P3 severity levels and SLAs

Vulnerability Disclosure policy with responsible disclosure commitments

Data Processing Addendum (DPA) summary page

Penetration Testing policy page

Private Document Portal (request access for NDA-gated documents)

Security contact form (direct disclosure to security@gorefer.io)

Sidebar navigation with grouped sections and active-page highlighting

The old /security page now redirects to /trust/security

Security Hub section with firm health score details

Field-level encryption list (SSN, EIN, bank accounts, driver's license)

Infrastructure section updated to reflect MongoDB Atlas migration

Added AI service providers to subprocessors list

Initial security & compliance page at /security

Six security pillars: Encryption, Tenant Isolation, RBAC, Auth, Monitoring, Infrastructure

Privacy Policy (v1.0)

Terms of Service (v1.0)

Cookie Policy