Security Exhibit

This Security Exhibit describes the baseline technical and organisational measures C4CI applies to C4CI Arch. It supports the Enterprise Master Services Agreement, Data Processing Addendum, Privacy Policy, and customer security review.

1. Security Program

C4CI maintains a security program designed for a multi-tenant B2B SaaS product that processes infrastructure metadata, architecture evidence, billing records, identity data, support data, and customer-controlled content.

The program is risk-based and evolves as the product, customer base, threat model, and regulatory expectations change.

2. Governance

C4CI maintains ownership for security controls, product changes, incident response, access review, legal-document rollout, and operational runbooks.

Security decisions are documented through architecture decisions, runbooks, code review, test evidence, and operational records where applicable.

3. Identity and Access Control

Baseline controls include:

1. authenticated access for protected product surfaces;
2. role-based access control for user, organisation, and platform-admin operations;
3. organisation-scoped tenancy for customer workspaces;
4. least-privilege integration posture where available, including Reader-first cloud discovery;
5. administrator access limited to personnel and systems with operational need;
6. removal or restriction of access when no longer required;
7. customer responsibility for identity-provider configuration, user offboarding, and role assignment.

4. Tenant Isolation

Arch is designed to keep organisation data scoped to the relevant tenant and authorised users. Product APIs, frontend routing, database queries, and integration flows are expected to preserve organisation boundaries.

Security findings that could expose another tenant's data are treated as high priority.

5. Encryption and Secrets

C4CI uses encrypted transport for supported production routes and relies on platform encryption controls for storage layers where available.

Secrets and credentials should be stored in designated secret-management systems or encrypted product stores, not in free-text prompts, comments, or support messages. Customer is responsible for using least-privilege credentials for connected systems.

6. Logging and Auditability

C4CI records audit and operational events for security, legal acceptance, billing, support, product-control, and administrative workflows where implemented.

Audit records may include user identifiers, organisation identifiers, event type, timestamps, content hashes, request metadata, and relevant product context. Audit records are protected according to the Privacy Policy and Data Processing Addendum.

7. Secure Development

C4CI's secure development practices include:

1. version-controlled source changes;
2. code review and automated tests for product changes;
3. targeted validation for legal registry and content-hash integrity;
4. dependency review and vulnerability management where tooling is configured;
5. structured architecture decisions for material changes;
6. separation between shared standards, product behavior, and environment configuration;
7. avoidance of invented operational or customer data in product artifacts.

8. Infrastructure and Operations

The platform is operated using cloud and Kubernetes infrastructure. Operational controls include runbooks, deployment validation, backup and restore practices, health checks, logging, monitoring, and incident-response workflows.

The product architecture targets Microsoft Azure, AKS, Key Vault, database services, Kubernetes addons, and region-specific deployment choices documented in product architecture decisions.

9. Vulnerability Management

C4CI triages vulnerabilities based on severity, exploitability, affected data, tenant isolation impact, operational exposure, and availability impact.

External vulnerability reports are handled under the Vulnerability Disclosure Policy. C4CI may prioritise fixes, mitigations, configuration changes, or customer notifications based on risk.

10. Incident Response

C4CI maintains an incident-response process covering:

1. detection and triage;
2. severity assignment;
3. containment;
4. investigation;
5. remediation;
6. customer communication where required;
7. post-incident review.

Customer-impacting security incidents are communicated according to the Data Processing Addendum, Support and SLA Policy, order form, and applicable law. C4CI maintains an internal security and privacy incident-response runbook that covers customer-impact assessment, personal-data-breach assessment, phased customer notices, evidence preservation, and post-incident review.

11. Backup and Recovery

C4CI maintains backup and restore practices for relevant platform components. Backup scope, schedules, retention, and recovery objectives may vary by environment and component.

Customer-specific recovery commitments apply only when stated in an order form or Support and SLA Policy.

12. Personnel and Confidentiality

Personnel with access to customer data or production systems are expected to be bound by confidentiality obligations and to access systems only for authorised business purposes.

C4CI may use contractors, advisers, or subprocessors where needed, subject to confidentiality and data-protection obligations appropriate to their role.

13. Customer Responsibilities

Customer is responsible for:

1. securing its identity provider, cloud accounts, repositories, billing accounts, and connected systems;
2. assigning least-privilege roles;
3. rotating credentials and removing stale access;
4. reviewing AI-assisted, architecture, drift, and remediation outputs before relying on them;
5. reporting suspected incidents to C4CI promptly;
6. avoiding unnecessary secrets and regulated data in free-text fields.

14. Certifications and Reports

SOC 2, ISO 27001, PCI, or other certifications apply only when C4CI has completed and published the relevant certification or report. Until then, C4CI may provide architecture summaries, control descriptions, test evidence, and security questionnaires as trust evidence.

15. Contact

Security questions should be sent to support@c4ci.io. Vulnerability reports should follow the Vulnerability Disclosure Policy.