Information Security Policy

1. Purpose and scope

This policy sets the security direction for PsiGuard, the AI structural-monitoring service operated by PsiCo, LLC at psiguard.net. It applies to the production service, its API, the systems and third-party providers it runs on, and every person with access to them. The four policies that follow (SEC-02 to SEC-05) implement it in specific areas; where they are more specific, they govern.

2. What we protect

• Customer content: prompts sent to the API or Playground and the answers delivered back.
• Credentials: PsiGuard API keys, customers' own AI-provider keys, and the service's infrastructure secrets.
• Account data: sign-in identity, plan and billing status, and usage records.
• The monitoring method itself: PsiGuard's internal signals, thresholds and calculations are trade secrets. They are produced and kept on our servers and are never exposed through the API, the user interface, logs sent to third parties, or documentation.

3. Principles

1. Handle as little as possible. The API returns an answer and a coarse protection signal, nothing else. Card payments never touch our systems. Keys are stored as one-way fingerprints, not as keys.
2. Protect what we do handle. Encryption in transit everywhere; provider keys encrypted at rest; hardened browser security headers on every response; rate limits on every route.
3. Keep it only as long as it is useful. Retention periods are fixed in code and enforced automatically (SEC-03), not left to someone remembering.
4. Say exactly what we do. Public statements about security describe controls that are actually in place. We do not claim certifications we do not hold.

4. Roles and accountability

PsiCo, LLC is owned by two partners. The Founder (Bradley Carter) builds and operates the product and is the owner of this policy and of every system covered by it; he is the only person who operates production. The co-founder originated the concept and takes no part in product development or operations; as a partner he holds sign-in access to the company's accounts (SEC-02 §6) but does not use it. There is no separate security team; the controls are designed so that one person can run them reliably, and so that an additional person can be added under SEC-02 without redesign.

5. Policy set

6. Third-party providers

PsiGuard runs on a small, fixed set of providers, each used for one job: Render (hosting), Google Firebase / Firestore (authentication and database), Stripe (payments), Resend (transactional email), Cloudflare (DNS and network security), and the AI model providers a customer connects (OpenAI, Anthropic, Google, DeepSeek, xAI, or the customer's own). The current list is published on the Security page and in the Privacy Policy. A provider is added only when the service cannot reasonably do the job itself, and the public list is updated in the same change.

7. Risk, review and exceptions

This policy and its companions are reviewed at least annually and whenever the service changes in a way that affects them (a new provider, a new class of data, a new access path). Any deviation from a policy must be deliberate, written down with the reason and the date, and reviewed at the next cycle. Where we are today: PsiGuard is in active beta and does not yet hold SOC 2 or ISO 27001 certification. These policies are the written foundation for that work and are kept honest so they can be audited against reality.