Our Security Posture

Majormatic is a Digital Vault architecture designed for professional work in regulated industries. Security is a structural property of the platform, not a layer added on top.

We operate on a principle of least privilege: every component, user, and integration receives only the access it requires. Access is never assumed and always verified. The Kernel is the sole execution authority — no developer, app, or user can bypass its rules.

Data is separated into three governed layers: raw evidence (temporary), processed results (linked to execution), and supervision patterns (governed by policy). Each layer has its own retention rules. The default active workspace window is 30 days. Vault extension is available for monetised continuity.

We do not make absolute security guarantees — no platform can. What we commit to is a phased, documented, and continuously improving security posture designed to meet regulated industry requirements at each phase.

Security Domains

🗄️

Data Protection

  • Data encrypted in transit using TLS 1.2 or higher
  • Data encrypted at rest using AES-256
  • 3-layer separation: raw evidence (temporary), processed results (linked), supervision patterns (governed)
  • Data classification: PUBLIC, USER_PRIVATE, REGULATED — each with distinct handling rules
  • 30-day active workspace window by default; vault extension available
  • Strict data minimisation — no indefinite default retention
  • GDPR-aligned data handling practices
  • Data deletion available on request
Privacy Policy →
🔑

Access Controls

  • Role-based access control (RBAC) available for organisational accounts
  • Principle of least privilege enforced by design
  • Session management with configurable timeouts
  • Multi-factor authentication available
  • API key management with scoped permissions
  • SSO integration available for enterprise service agreements
Account Security Settings →
📋

Compliance Standards

  • GDPR-aligned data processing practices
  • UK Data Protection Act 2018 compliance
  • Tamper-evident audit records retained according to policy for compliance review
  • Data residency options available under enterprise service agreements
  • Documented data processing agreements available
  • Regular internal security reviews
Compliance Enquiries →
🏗️

Infrastructure Security

  • Hosted on enterprise-grade cloud infrastructure
  • Network isolation between execution environments
  • Regular dependency and vulnerability patching
  • Automated monitoring and alerting
  • Redundant architecture for availability
  • Regular backup and recovery testing
📦

App Execution Isolation

  • Apps execute in isolated, scoped environments
  • No cross-user data access between executions
  • Apps cannot access platform internals
  • Resource constraints enforced per execution
  • All apps reviewed before publication
  • App permissions explicitly declared and limited
Governance Model →
🚨

Incident Response

  • Documented incident response procedures
  • Security team on-call for critical issues
  • Affected users notified within required timeframes
  • Post-incident reviews and remediation
  • Security disclosures handled responsibly
Report a Security Issue →

Security Roadmap

Our security capabilities are phased by data sensitivity. Each phase unlocks the platform for a broader class of regulated data.

Phase 1 — Current

Law Firms & Professional Services

Public data. Full governance, audit trails, lifecycle management, and AI+Gov API hybrid. Designed for law firms, accountants, and consultants handling publicly available data and client-facing professional outputs.

Phase 2 — Planned

Firm Internal Data

Private matter data, internal documents, firm-confidential workflows. Enhanced data separation, restricted supervision pattern tiers, and role-based access controls for multi-seat firm accounts.

Phase 3 — Roadmap

Sensitive Regulated Data — Banks & Hospitals

Banking and healthcare data. ISO 27001 certification, full jurisdictional compliance enforcement, multi-expert approval for CRITICAL risk executions, advanced audit and data residency controls.

Jurisdiction Enforcement

Every execution carries a jurisdiction context that controls which regulatory sources and enforcement rules apply. This is not advisory — it is structural.

Region

UK, EU, or other defined regions. Governs which government API sources are authoritative for this execution.

Regulatory Source

Linked to the applicable government API (UK Gov legislation, HMRC, Companies House, EUR-Lex). AI output is grounded against the authoritative source.

Enforcement Mode

STRICT (execution blocked on conflict) or ADVISORY (conflict flagged, execution proceeds). Enterprise accounts can configure jurisdiction enforcement per workspace.

Failure Protocol

Majormatic defines explicit failure states. The platform does not assume success. When execution encounters uncertainty, conflict, or missing data, the platform follows defined escalation rules — not defaults.

API Failure
RETRY or BLOCK

External authority API unavailable. Retry once; if unresolved, block execution and notify user.

AI Uncertainty
ESCALATE TO HUMAN

AI confidence below threshold. Execution is flagged and escalated for human review before proceeding.

Regulatory Conflict
REQUIRE OVERRIDE

Conflicting regulatory sources identified. User must explicitly override with a recorded DECISION supervision pattern.

Missing Data
HALT

Required data absent from pipeline truth or inputs. Execution halts. User must resolve before proceeding.

Responsible Disclosure

We take security vulnerabilities seriously. If you discover a potential security issue, we ask that you report it to us privately before any public disclosure.

1
Contact our security team

Email [email protected] with details of the issue.

2
We acknowledge receipt

We will confirm receipt within 24 hours for critical issues and 5 business days for others.

3
We investigate and remediate

We will investigate, develop a fix, and keep you informed of progress.

4
Coordinated disclosure

We will work with you on appropriate public disclosure timing once the issue is resolved.

Please do not: publish or share vulnerability details publicly before we have had an opportunity to address them.

Our Security Principles

Least Privilege

Every system component, user, app, and integration receives the minimum access needed to function. Permissions are explicit, not assumed.

Defence in Depth

Security controls are layered. No single layer is treated as sufficient. Failures in one layer are mitigated by others.

Transparency Over Obscurity

We do not rely on secrecy as a security mechanism. Our security posture is documented and available for review by customers.

Continuous Improvement

Security is never complete. We regularly review, test, and improve our controls as threats and our platform evolve.

Related

Security Questions?

Our team is available for enterprise security reviews and compliance enquiries.