IthilTrust Center
Lives depend on this software, so compliance auditability is built into every layer, not bolted on. Here is our security, compliance, and accessibility posture, plus the documents your procurement and security teams need to evaluate Ithil.
Compliance & certifications
Status is stated honestly: a mapping in progress is labeled as such, never as an authorization.
SOC 2 Type II
In progressType I readiness controls are implemented across the platform. The Type II observation period begins after our first paying customer.
NIST 800-53 Rev 5
In placeControl mapping documented across twenty-one control domains for federal compliance assessments.
FedRAMP Moderate
In progressControl mapping in progress for federal deployments. Federal and DoD-adjacent tenants run as a separate deployment fork.
GovRAMP Moderate
In progressControl mapping in progress for state and local government deployments.
CMMC Level 1
In progressSelf-attestation drafted for CUI-adjacent work. The edge collector ships a FIPS 140-3 build.
FIPS 140-3
In placeCryptographic operations use FIPS 140-3 validated modules through AWS KMS. SHA-256 hash chains protect every audit trail.
Section 508 / WCAG 2.1 AA
In placeThe platform is built to WCAG 2.1 AA, meeting Section 508. A VPAT is available on request.
GASB 34
In placeThe data model supports GASB 34 government capital-asset reporting.
Penetration tested
In placeTested by Cobalt, a CREST-accredited offensive security firm. Results are available on request.
Documents available on request
Under NDA where appropriate, we share the artifacts your review needs:
- SOC 2 readiness report
- Penetration test results (Cobalt)
- VPAT (Section 508 / WCAG 2.1 AA)
- Data Processing Addendum (DPA)
- Security questionnaire (CAIQ / SIG)
- NIST 800-53 control mapping
Request the trust package at security@ithil.ai or through our contact form.
How customer data is protected
Encryption
AES-256 at rest via KMS envelope encryption; TLS 1.3 in transit. No data is unencrypted at any layer.
Tenant isolation
Each customer's data lives in its own Postgres schema. No query executes without tenant context.
US data residency
All infrastructure runs on AWS in US regions (us-west-2), inside isolated VPCs with no public database access.
Domestic operations
Built and operated entirely by a US-based team. No development or support is outsourced offshore.
Immutable audit trail
Work orders and inspections are event-sourced with SHA-256 hash chains. A daily worker replays every chain and pages on any mismatch.
Destruction defense
Production data is protected by seven independent layers, the capability to destroy is removed, not merely discouraged.
Explore
Bring your security team
We will walk through controls, share evidence under NDA, and answer your questionnaire.