Security, stated control by control.

Every control is marked as current practice, scoped to an engagement, or still ahead of us.

Request diligence materialReport a vulnerability
19 controls across 6 lifecycle layersSudens' own classification · not independently assessed
  • 12/19Current practice
  • 4/19Engagement-scoped
  • 3/19Planned maturity work
  • L1Governance
  • L2Design
  • L3Build
  • L4Verify
  • L5Release
  • L6Operate

Six layers. Every control marked.

Open a layer to read its controls; the stack lights the one you are reading.

L1Governance

Who is accountable for security decisions?

Security ownership sits with named engineering leadership on each engagement rather than with a separate function that reviews work after it is built.

  • L1.1Current practiceEach engagement has a named technical owner accountable for security decisions and residual risk.
  • L1.2Current practiceSecurity requirements are captured with the functional requirements and tracked to verification.
  • L1.3Planned maturity workA published internal security policy set, reviewed on a fixed cycle, with a named security owner across engagements.
L2Design

What can go wrong, and what does the architecture do about it?

Threat modelling happens while the architecture is still cheap to change, and its output is a register with owners rather than a document.

  • L2.1Current practiceThreat modelling on system boundaries, trust zones, data flows and failure modes before implementation.
  • L2.2Current practiceData classification and boundary decisions recorded in architecture decision records.
  • L2.3Engagement-scopedPrivacy and retention decisions agreed with the client's accountable owner before any pipeline is built.
L3Build

How is the software and its supply chain controlled?

Source control, review and dependency handling are treated as part of the product's security posture, not developer preference.

  • L3.1Current practiceVersion-controlled source with peer review required before merge to a release branch.
  • L3.2Current practiceDependencies are pinned, reviewed on update, and monitored for published vulnerabilities.
  • L3.3Current practiceSecrets are held in a managed store, never in source control, with environment separation.
  • L3.4Planned maturity workBuild provenance and signed artifacts across all delivery pipelines.
L4Verify

What evidence exists that the controls work?

Verification is automated where it can be repeated and manual where judgement is required — and the result is recorded either way.

  • L4.1Current practiceAutomated tests gate the pipeline; a failing gate blocks release rather than raising a warning.
  • L4.2Current practiceSecurity requirements are verified against their recorded acceptance criteria before release.
  • L4.3Engagement-scopedIndependent penetration testing or assessment, scoped with a named qualified partner and reported separately.
L5Release

How does change reach production safely?

Deployment is a controlled, reversible operation with a defined approval path.

  • L5.1Current practiceSeparated environments with controlled promotion and least-privilege deployment access.
  • L5.2Current practiceRollback path defined and rehearsed before go-live approval.
  • L5.3Engagement-scopedChange approval and audit trail aligned to the client's own change-management requirements.
L6Operate

How would you know, and what would you do?

Monitoring, alerting and incident readiness are delivered with the system, and incidents feed back into design.

  • L6.1Current practiceMonitoring, logging and alerting delivered with the system, with runbooks for known failure modes.
  • L6.2Engagement-scopedIncident handling, communication and remediation responsibilities agreed with the client before go-live.
  • L6.3Planned maturity workPublished service commitments and response times across all managed engagements.
L1Governance2/3 current practiceL2Design2/3 current practiceL3Build3/4 current practiceL4Verify2/3 current practiceL5Release2/3 current practiceL6Operate1/3 current practice
  • Tall, lit · Current practice
  • Half height · Engagement-scoped
  • Flat outline · Planned maturity work

From commit to production. Lit where it is routine.

Build, verify and release controls in the order a change meets them.

  1. L3 Build
    1. Source & reviewL3.1Current practice
    2. DependenciesL3.2Current practice
    3. SecretsL3.3Current practice
    4. ProvenanceL3.4Planned maturity work
  2. L4 Verify
    1. Pipeline gateL4.1Current practice
    2. Security acceptanceL4.2Current practice
    3. Independent testL4.3Engagement-scoped
  3. L5 Release
    1. PromotionL5.1Current practice
    2. RollbackL5.2Current practice
    3. Change approvalL5.3Engagement-scoped

Each step's full statement is under its code in the lifecycle above.

Client data and access, kept to the minimum.

As little client data as the work needs, where the client can see it, for only as long as the engagement lasts.

ProductionDevelopmentRepresentative dataClient environment
  • 3Current practice
  • 1Engagement-scoped
  • 1Planned maturity work
  1. DA.1Current practice

    Access is granted per person and per environment, on least privilege, and revoked at offboarding.

  2. DA.2Current practice

    Production data is not copied into development environments; representative or anonymized data is used instead.

  3. DA.3Current practice

    Encryption in transit and at rest for systems Sudens builds and operates, using the platform's managed capabilities.

  4. DA.4Engagement-scoped

    Retention and deletion terms, including what happens to data at the end of the engagement, are agreed in writing per engagement.

  5. DA.5Planned maturity work

    Subprocessor and hosting summary maintained and available on request.

Applied in our own products first.

Each commitment is the product's own public wording.

VM-ADR-004 · VieroMind · Architecture decision recordAcceptedPublished commitment · record format illustrative

Journal entries are never available for model training

Context

The journal is where people write what they would tell no one else. Reflection features need a model to read an entry at the moment of use. Training on entries would improve those features — and would turn the most sensitive data on the platform into a product input.

Options considered
  1. Train on entries from users who opt inRejected
    Consent given in distress is not a reliable basis for reuse.
  2. Train on a de-identified journal corpusRejected
    Free-text journals cannot be dependably de-identified.
  3. Inference-only access, encrypted end to end, nothing retainedChosen
    The feature works; the entry stays the person's.
Trade-off accepted

Reflection quality improves more slowly, from licensed and synthetic data only. In exchange, the platform can state its privacy commitment without qualification.

Owner
Product engineering lead
Reviewed by
Foundation privacy owner
Linked
Privacy-first architecture · User-controlled sharing

Ravius

  • Privacy-first by design: employees choose what they share, within the applicable privacy settings.
  • Role-based access — leaders see team-level patterns, not individual surveillance.
  • Viero AI is a reflection assistant. It is not medical care and does not diagnose or treat.
Ravius product detail

VieroMind

  • No AI training on personal data.
  • User-controlled data sharing.
  • Privacy-first architecture with healthcare-grade security.
VieroMind product detail

Datok

  • Reporting-only by design: Datok reads from the platforms a business authorizes and does not change its advertising accounts.
  • A connector is listed as available only after a real authorization and a real sync against the provider's production API.
  • Numbers are computed on the server from stored source records, traceable to an account, a sync run and a date range.
Datok product detail

Certification and compliance position

Sudens does not currently hold, and does not claim, ISO 27001, SOC 2, HIPAA or any other certification, and does not present a cloud provider's certifications as its own.

  • ISO 27001Not held · not claimed
  • SOC 2Not held · not claimed
  • HIPAANot held · not claimed

Where an engagement requires independent assessment or a specific regulatory position, it is scoped explicitly, delivered with a named qualified partner where appropriate, and reported separately from this page.

Material for your review. Listed as it stands.

Controlled material is shared under a confidentiality agreement.

  • Public

    Security practice overview

    The lifecycle practices on this page, in a form that can be attached to a diligence pack.

    Read it on this page
  • Available on request

    Data handling and retention statement

    How client data is accessed, stored, separated, retained and deleted for a given engagement scope.

    Request the statement
  • Available on request

    Security questionnaire response

    Completed against your questionnaire, with scope boundaries stated rather than assumed.

    Send us your questionnaire
  • In preparation

    Internal security policy set

    Formal policy documents under a fixed review cycle. Being written up; not yet available as a controlled document.

    Not yet available

Reporting a vulnerability. Straight to a reviewer.

Report a vulnerability
  1. 01

    We acknowledge the report and confirm a named reviewer.

  2. 02

    We confirm whether the issue is reproducible and who owns the remediation.

  3. 03

    We tell you when it is resolved, and what changed.

Planned maturity work

Published acknowledgement and remediation time commitments are part of our planned maturity work. We are not publishing response times we cannot yet meet consistently.

  • Affected system
  • What you observed
  • Steps to reproduce
  • No client production data
Full reporting guidance

If you believe you have found a vulnerability in a system Sudens builds or operates, report it to us directly. Security reports do not go through the sales qualification form — the security reporting route reaches a technical reviewer with the context needed to act.

Please include the affected system, what you observed, and the steps required to reproduce it. Do not include client production data in the report.

Bring the questionnaire. We answer with scope stated.

Diligence requests are handled by the engagement lead together with the technical owner for the material requested.

  1. On requestData handling and retention statement
  2. On requestSecurity questionnaire response
Deciding the system first? See the Architecture Sprint

A person replies; it is not a no-reply address.

For example: CTO, Head of Operations, Product Director.

For example: data-handling statement, security questionnaire response, architecture overview, or case evidence for a specific engagement type.

Vendor assessment, procurement stage, security review, or internal approval — and any deadline attached to it.

If a date matters — a board meeting, a launch, a contract.

What you send is used to respond to your inquiry and is shared only with the people reviewing it. Please do not submit production data, credentials, personal data about others, or anything you would not want in an email.