Women & Minority-Owned Company

Trust Center

Security, privacy, and compliance are first-class requirements in every engagement. Below we outline our current controls and our roadmap toward formal attestations.

Encryption
TLS 1.2+ in transit; provider-managed at rest
RBAC + MFA
Role-based access; MFA for privileged roles
Monitoring
Centralized logs, alerts, incident response

Where certifications are pending, we disclose status and align our controls with SOC 2 and ISO/IEC 27001 principles.

Security

Controls

Data Protection

  • TLS 1.2+ encryption in transit; encryption at rest.
  • Secrets vaulted; least-privilege keys with rotation.
  • Backups with retention policy; tested restores.
Access

Identity & Device Security

  • RBAC across environments; quarterly access reviews.
  • MFA for privileged roles; endpoint protection & patch baselines.
  • Session logging and anomaly monitoring.
SDLC

Secure Development

  • Git-based change control; peer reviews; CI checks.
  • Dependency scanning and SAST in pipeline.
  • Separate dev/test/prod with change approvals.
Ops

Monitoring & Incident Response

  • Centralized logging and alerting for critical services.
  • Documented IR plan with severity levels and RACI.
  • Post-incident reviews and corrective actions.
Framework Alignment: Controls aligned with SOC 2 and ISO/IEC 27001 principles. Formal attestations planned per roadmap.

Privacy

Policy

Data Handling

  • Purpose limitation; no resale of client data.
  • Data minimization and retention schedules.
  • Deletion upon request per contract and law.
Health

HIPAA-Ready Practices

  • BAAs with covered entities and processors as needed.
  • Access logging for PHI systems; workforce training.
  • Secure transmission channels and encryption.
Global

Regional Compliance

  • GDPR-aligned rights handling (access, correction, deletion).
  • US state privacy readiness (e.g., CCPA/CPRA).
  • Cross-border transfer safeguards (standard clauses).
Contracts

NDAs & DPAs

  • Mutual NDAs by default; client DPAs supported.
  • Subprocessor transparency upon request.
  • Audit cooperation clauses where applicable.

Ethical AI

Principles

Responsible AI

  • Fairness, transparency, and accountability by design.
  • Pre-deployment validation for bias and accuracy.
  • Human-in-the-loop for sensitive decisions.
Ops

Model Governance

  • Dataset provenance and consent review.
  • Versioned models with rollback and monitoring.
  • Clear user disclosures for AI-assisted features.

Responsible Disclosure

Report potential vulnerabilities to security@animsolutions.us with steps to reproduce. We'll acknowledge, triage, and keep you updated through remediation.

Compliance Roadmap

Q4 2025 — Readiness
  • Formalize policies: Security, Privacy, IR, DR, Vendor Mgmt.
  • Risk assessment & gap analysis (SOC 2/ISO 27001).
  • HIPAA audit readiness package.
H1 2026 — Attestations
  • SOC 2 Type I (selected scope); external audit partner.
  • ISO/IEC 27001 readiness sprint with internal audits.
  • Annual security assessment & penetration test.