Security controls and current status

Cellect is preparing for an initial SOC 2 Type I examination of its product environment and supporting production systems. Fi is currently Cellect's only product and is therefore the product in the present examination scope. No report has been issued, and Cellect does not represent itself as SOC 2 compliant or certified.

CellectAI Inc is currently owner-operated with no employees or contractors holding production access. Controls are designed for that actual operating model rather than assuming a larger security organization.

Cellect is not aware of any confirmed unauthorized access to customer data in its product environment. Fi is currently Cellect's only product. Security events and suspected incidents are tracked under the incident-response process.

Cellect's product environment runs on Cellect-managed infrastructure in a restricted-access United States office environment. Fi is currently the only product in that environment. Detailed network and physical-location information is shared only when appropriate during a security review.

The office is protected by keypad access. Production equipment and access credentials are controlled by Cellect's owner, the only person currently authorized for physical or administrative access.

Cellect backs up its current product data. Fi database backups are encrypted and restore-tested. Cellect is adding a separately located encrypted copy before selecting the SOC 2 Type I examination date.

Cellect's current product, Fi, applies organization, company, project, and capability-level authorization. A user without an explicit resource grant cannot view that resource, and administrative routes require elevated authorization. New products must define and test equivalent access boundaries before handling customer data.

Cellect product access currently uses centralized identity and short-lived application sessions. Fi is the current implementation. Administrative access is distinct from ordinary customer access.

Public traffic to Cellect products, including Fi, and the trust center is encrypted with HTTPS. Internal service paths are being inventoried as part of SOC 2 readiness, so Cellect does not yet claim universal transport encryption between every internal component.

Cellect encrypts backups and uses application-level encryption for selected high-risk fields. A complete storage-encryption inventory is in progress; detailed claims are withheld until that verification is complete.

Cellect uses commercial API services from Anthropic, Google, and OpenAI. Their standard commercial terms do not use API inputs and outputs for general model training unless a customer opts in. Cellect has not yet verified zero-data-retention status and therefore does not claim ZDR; limited provider safety or abuse-monitoring retention may apply.

Researchers and customers can report suspected vulnerabilities privately to security@cellect.ai. Cellect requests good-faith testing that avoids privacy violations, service disruption, and access to data belonging to others.

Cellect product changes are version-controlled and subject to risk-appropriate automated checks. For Fi, these include type, lint, test, and production-build checks. Cellect is formalizing production change records and deployment approvals for its owner-operated model before the Type I examination date.

An independent penetration test of Cellect's current product environment, which presently consists of Fi, is planned as part of the readiness program. No completed test report is currently available.