Security and data handling
The five questions a reviewer asks first.
Each answer states what is true today, including what Factum does not hold and does not offer.
What data do you process, where is it kept, for how long, and do you train on it?
You send a document and a declared question. Factum reads the document and returns a certificate. By default nothing is kept. The certificate archive defaults to zero bytes.
If you buy certificate storage, Factum keeps the exact signed bytes of each certificate you issue, up to the size you buy, and records every eviction. If you use the gateway, Factum keeps the facts read from your documents, each with its source position, in a store that belongs to your tenant alone.
Factum trains no model on your data. Its verdicts are deterministic and use no model. If you configure your own AI engine key, for report types that write prose or for the clerk, the relevant content of your document and what you say to the clerk go to that vendor under your account. With no engine key configured, no content goes to any AI vendor. An engine is admitted by measurement before it is used: how.
Is data encrypted, and how are keys managed?
Traffic is HTTPS, terminated at the hosting provider's edge. Your API keys are shown to you once and stored only as salted scrypt hashes.
Certificates are signed with an Ed25519 key that exists only as an environment secret on the production service. It is minted straight into that secret and is never printed or written to a file. The service refuses to start without it. Retired public keys stay published, so old certificates keep verifying.
Application-level encryption at rest and customer-managed keys are not offered today. Data at rest relies on the hosting provider's disk.
Which attestations do you hold?
Factum does not hold a SOC 2 or ISO 27001 report today. SOC 2 is on the roadmap.
What Factum offers is something an attestation cannot: every certificate is independently checkable. You can verify the signature yourself, re-run the same input and get the same findings, and read the rule versions and derivations inside the certificate.
A re-run proves the output. It does not attest to hosting, access control or operations. Ask for the security specification and the measured security census behind it.
Who are your subprocessors?
One party processes customer data by default: the hosting provider, which runs the service, its disk and its TLS edge.
Two more are reached only if you turn them on. The first is the AI engine vendor whose key you configure yourself. The second is an RFC 3161 timestamp authority for certificate timestamps, which receives only a certificate's hash. No other outbound call carries customer data.
The parties are named in the security specification, which is provided on request.
What happens if there is a security incident?
Every request against your tenant is recorded in an access audit log. The log holds the key's public id and never the key or the request body. Keys can be disabled at once, and an issuer signing key can be rotated with the old public key kept published.
Factum commits to notifying affected customers within 72 hours of confirming a breach that affects customer data. An Enterprise agreement may set a shorter window. The incident-response plan states its own limits and is provided with the security specification.
What a certificate does not state
A certificate states what was examined, against which declared rules, with what result. It is designed for audit and evidentiary use, and the receiving party decides what it accepts. Every certificate names what it does not certify, under the heading NOT ATTESTED.