Skip to content
Falnoa

Trust

What is real.What is not.

Only what we can prove.

Message us

What exists today

  • Roles

    Administrator, operator and viewer, enforced on the server.

    Tested

  • Sign-in

    Strong password storage, authenticator app, recovery codes and passkeys.

    Verified

  • Single sign-on

    OpenID Connect, checked against one identity provider only. Others are documented, not tested.

    Verified

  • Audit log

    Hash-chained, exportable. It detects changes in a copy; it is not write-once storage.

    Verified

  • Stored credentials

    Encrypted with a key you provide, with key rotation.

    Verified

  • Personal data tools

    Retention, export and erasure of a person, and detection of emails, IBANs, tax numbers and card numbers. Names in free text are not detected.

    Tested

  • Human control

    Written reasons on approvals, two-person approval, emergency stop for every agent.

    Tested

  • Isolation

    One instance per customer. Runs as a non-root container with no extra privileges.

    Verified

  • Telemetry

    Off until you configure it. The product reports to no vendor.

    Verified

Verified: run for real and the evidence is kept. Tested: covered by automated tests with simulated agents and models.

What does not exist yet

  • Certifications

    No SOC 2 report, no ISO 27001 or ISO 42001 certificate.

  • External penetration test

    None has been done.

  • Signed data processing agreement

    Draft templates exist; counsel has reviewed none.

  • Legal assessment

    GDPR and EU AI Act obligations have not been assessed. The risk class in the register is the customer’s own, not a legal ruling.

  • High availability

    One active instance per customer, with backup and restore.

  • Customer deployments

    No version has been released to a customer environment yet.

Need more detail?Ask us.

We answer in writing, plainly.

Message us