Enterprise-Grade Security
Your data is protected by industry-leading security practices, encryption, and infrastructure — so you can focus on building, not worrying.
Security Pillars
Five foundational layers that protect every interaction with Alfred AI.
Data Encryption
All data is encrypted at rest with AES-256 and in transit using TLS 1.3. API tokens and secrets are hashed — never stored in plain text.
Post-Quantum Crypto
Kyber-768 hybrid key exchange protects communications against future quantum computing threats. Classical ECDH + Kyber lattice-based KEM — both must be broken simultaneously.
Veil Fortress
10-layer encryption stack combining post-quantum Kyber-768 + Dilithium signatures, Double Ratchet forward secrecy, hash chains, key commitment, and steganographic obfuscation.
Access Control
Role-based access control (RBAC), multi-factor authentication (MFA), and strict session management ensure only authorized users access your data.
Infrastructure
DDoS protection, Web Application Firewall (WAF), rate limiting, and automated anomaly detection keep the platform resilient 24/7.
Compliance
SOC 2 Type II on our roadmap, GDPR ready, HIPAA considerations in place, and alignment with PCI DSS for payment handling.
Technical Details
A closer look at how we secure every layer of the stack.
- Password hashing — bcrypt with a cost factor of 12; passwords are never stored in plain text.
- Session management — HTTP-only, Secure, SameSite cookies; sessions invalidated on logout and after inactivity.
- OAuth 2.0 — Sign in with Google and Facebook using industry-standard flows.
- API keys — Scoped, rotatable keys with SHA-256 hashed storage.
- Multi-factor authentication — TOTP-based 2FA available for all accounts.
- MySQL encryption — Transparent Data Encryption (TDE) at the storage engine level; data at rest encrypted with AES-256.
- Hashed tokens — API keys, webhook secrets, and session tokens are hashed before storage.
- No plain-text secrets — Environment variables loaded from files outside the webroot; never committed to version control.
- Automated backups — Daily encrypted backups with 30-day retention.
- HTTPS enforced — All traffic redirected to HTTPS via 301; HSTS enabled with
includeSubDomainsandpreload. - Content Security Policy — Strict CSP headers prevent XSS, clickjacking, and unauthorized resource loading.
- X-Frame-Options — Set to
SAMEORIGINto prevent framing attacks. - X-Content-Type-Options —
nosniffprevents MIME-type sniffing. - Rate limiting — mod_evasive and application-level throttling protect against brute-force and DDoS.
- Rate limiting — Per-key and per-IP throttling; 429 responses with
Retry-Afterheaders. - Input validation — All inputs sanitized and validated server-side; prepared statements for all queries.
- CSRF protection — Token-based CSRF guards on all state-changing endpoints.
- Webhook signatures — HMAC-SHA256 signatures on all outbound webhooks for payload integrity verification.
- CORS — Strict origin validation; only
gositeme.comdomains allowed.
- Audit logging — All authentication events, API calls, and administrative actions are logged with timestamps and IP addresses.
- Anomaly detection — Automated alerts for unusual login patterns, spike in errors, and suspicious API usage.
- Incident response — Documented playbook with escalation tiers; target < 1 hour acknowledgement for critical issues.
- Health monitoring — Real-time service health checks at /status with database, Redis, WebSocket, and MCP uptime tracking.
Veil Fortress Encryption Stack
10 independent cryptographic layers protect every message. An attacker must defeat all 10 simultaneously — breaking any single layer reveals nothing.
Transparency Commitments
We believe trust requires transparency. Here are our public commitments to you.
Warrant Canary
GoSiteMe / Alfred AI has NOT received any of the following as of the date below. If this section is ever removed or these statements are absent, assume our position has changed.
No-Backdoor Commitment
GoSiteMe / Alfred AI will never install secret surveillance capabilities, weaken encryption algorithms, or create covert access points at the request of any government, law enforcement agency, or third party. Our Veil Fortress encryption is designed so that even we cannot read your encrypted communications. This commitment is legally binding and documented in our Terms of Service (Sections 67–75) and Privacy Policy (Sections 32–37).
Compliance Matrix
How our security controls map to major compliance frameworks.
| Security Feature | SOC 2 | GDPR | HIPAA | PCI DSS |
|---|---|---|---|---|
| Data encryption at rest (AES-256) | ||||
| Encryption in transit (TLS 1.3) | ||||
| Role-based access control | ||||
| Multi-factor authentication | — | |||
| Audit logging | ||||
| Data retention policies | — | |||
| Post-quantum encryption (Kyber-768) | ||||
| Veil Fortress 10-layer encryption | ||||
| Warrant canary | — | — | — | |
| Right to deletion | — | — | — | |
| Incident response plan | ||||
| Vulnerability management | Roadmap | Roadmap | ||
| Formal SOC 2 audit | Roadmap | — | — | — |
Responsible Disclosure
We value the security research community and welcome responsible reports.
Report a Security Issue
If you've discovered a potential vulnerability in Alfred AI or any GoSiteMe service, please report it to our security team. We investigate every report and aim to respond within 48 hours.
security@gositeme.comScope
- gositeme.com and all subdomains
- Alfred AI platform (web, API, voice, WebSocket)
- GoCodeMe IDE
- Public-facing API endpoints
Rules of Engagement
- Do not access, modify, or delete data belonging to other users.
- Do not perform denial-of-service attacks or social engineering.
- Provide a detailed description, reproduction steps, and potential impact.
- Allow reasonable time for us to investigate and remediate before public disclosure.
Rewards
We offer recognition and, for qualifying vulnerabilities, rewards at our discretion. Severity is assessed using CVSS v3.1 scoring.
Hall of Fame
No submissions yet — be the first responsible reporter recognized here.
Data Processing
Transparency about how and where we handle your data.
Data Location
All primary data is stored on servers located in Quebec, Canada. We use Canadian data centres that comply with PIPEDA and Quebec's Law 25.
Retention Policies
- Account data — Retained while account is active, deleted within 30 days of account closure.
- Conversation logs — Retained for 90 days, then anonymized or deleted.
- Audit logs — Retained for 1 year for security and compliance.
- Backups — Encrypted daily backups retained for 30 days.
Deletion Rights
You may request the deletion of your personal data at any time by contacting privacy@gositeme.com. We process deletion requests within 30 days in accordance with GDPR and Quebec's Law 25.
Security FAQ
Common questions about how we protect your data.
Yes. All data is encrypted at rest using AES-256 and in transit using TLS 1.3. API tokens and secrets are hashed with SHA-256 before storage — we never store them in plain text. Communications through Alfred AI are additionally protected by our Veil Fortress 10-layer encryption stack, which includes post-quantum Kyber-768 + Dilithium signatures, Double Ratchet forward secrecy, and steganographic obfuscation.
Veil Fortress is our proprietary 10-layer encryption protocol. Unlike standard TLS which uses a single encryption layer, Veil Fortress wraps every message in 10 independent cryptographic layers: Kyber-768 KEM, ECDH P-256, AES-256-GCM, HKDF-SHA256, ECDSA P-256, Dilithium PQ Signatures, Double Ratchet, Hash Chains, Key Commitment, and Steganographic Obfuscation. An attacker must break all 10 simultaneously — compromising any single layer reveals nothing.
No. Veil Fortress uses end-to-end encryption with client-side key generation. Encryption keys are generated and managed on your device — they never travel to our servers. Even our own engineering team cannot decrypt your protected communications. This is by design and is a legally binding commitment in our Terms of Service and Privacy Policy.
All primary data is stored in secure data centres located in Quebec, Canada. Our infrastructure complies with Canadian privacy legislation (PIPEDA) and Quebec's Law 25.
Absolutely. Contact privacy@gositeme.com to request full deletion of your personal data. We process requests within 30 days.
No. We never sell, rent, or trade your personal information to third parties. Your data is used solely to provide and improve Alfred AI services. See our Privacy Policy for full details.
SOC 2 Type II certification is on our roadmap. We already implement the controls required by the Trust Services Criteria (security, availability, confidentiality) and are actively working toward a formal audit.
Security You Can Trust
Try Alfred AI with confidence — your data is protected by 10-layer Veil Fortress encryption, post-quantum cryptography, and a legally binding no-backdoor commitment.
Try Alfred Free
Someone from somewhere
just launched website.com
Just now