Security
Security and compliance
What is in force, what is in flight, and what stays on request. Not a certificate.
Jun 30, 2026
A yard is a customer's site. Sensor bags, door events, and trailer identities are their data. This page is the control summary a partner asks for before they put us on a vendor list. It is not a SOC 2 report and it does not claim we are certified.
Data residency
Raw recordings do not leave a pharma or port site. Training happens on-prem or in a customer-approved region. Model weights can leave; the bags do not. That term is in the MSA, and it is restated on the architecture page so engineering and legal say the same thing.
Access
Investor and admin logins are the company's identity provider — Google or Microsoft — with an allowlist. There is no shared yard password. Production access to a site graph is named, time-boxed, and logged.
Attestation
SOC 2 Type I fieldwork is scheduled for Q4 2026. Until a report exists, do not write "SOC 2" on a customer slide. Pen test is annual; the last run was March 2026. Critical findings are closed. The report itself is on request under NDA — it is not attached here.
Incidents
No reportable incidents as of June 2026 (preliminary close).
What this page is not
Not HIPAA coverage. We do not store pedigrees or patient data. A pharma 3PL site is still a trailer yard. Not a vehicle-safety certification — the partner tractor carries its own. Not an ISO 27001 certificate.
A public fork should replace this page with the company's real control report, subprocessors, and counsel's wording. Keep the carve-out. Do not bury security inside the architecture memo.