Security / trust posture
Security for senior-leader ideas
Maitro protects applications, venture briefs, member records, and commercial terms with scoped access, limited sub-processors, conflict review, incident routes, and clear current-vs-roadmap labels.
Claim discipline
Premium does not mean reckless.
This page separates current controls, roadmap targets, illustrative tools, gated economics, and agreement-controlled terms so senior leaders can evaluate Maitro without mistaking posture for guarantee.
No resale
Maitro should say no data resale, not blanket no-sharing. Limited vendors support core operations.
Primary India posture
Production hosting is described as India/Mumbai posture. Global sub-processors mean absolute residency language is avoided.
SOC 2 target
SOC 2 Type II is roadmap language only until a third-party report exists.
Current vs target
Security posture matrix
Each control is labeled by implementation posture so reviewers can distinguish production reality from roadmap.
| Area | Current / target posture | Status | Claim note |
|---|---|---|---|
| Encryption | Transport encryption is enforced at the web edge. Application-level encryption exists for selected sensitive records. | Source-needed | AES-256 at rest and TLS 1.3-only wording should stay source-needed until infrastructure evidence is attached. |
| Access control | Admin surfaces use authenticated access and role checks where implemented. | Current control | Least-privilege and hardware-key MFA remain policy targets unless operator evidence is linked. |
| Logging and audit | Key APIs write structured logs and selected workflows write audit rows. | Current control | Public copy should not imply every operator action is fully automated and audited until coverage is verified. |
| Sub-processors | Limited vendors support hosting, email, payments, auth, analytics, anti-bot, and error telemetry. | Current control | Use limited sub-processors under policy controls; avoid blanket no-sharing language. |
| SOC 2 | SOC 2 Type II is not presented as certified. | Planned | SOC 2 readiness and audit windows are roadmap targets until a report exists. |
| Incident response | Security contact route exists. Incident handling follows legal and policy requirements. | Policy target | Avoid hard universal 72-hour user notification promises. |
Sub-processors
Limited vendors, listed plainly
The right trust posture is limited sub-processors under policy controls, not a blanket no-third-party claim.
| Vendor | Purpose | Data category | Region | Status | Notes |
|---|---|---|---|---|---|
| Hostinger KVM | Application hosting | Application, member, and operational records | Mumbai / India posture | Current | Primary production hosting. Exact backup region should be founder/security-confirmed. |
| Cloudflare | DNS, CDN, DDoS protection, Turnstile anti-bot | Network metadata, anti-bot tokens, request metadata | Global edge | Current | Do not claim absolute India-only residency while global edge services are used. |
| Brevo | Transactional and newsletter email | Email address, message metadata, transactional content | EU / vendor-controlled | Current | Email implementation imports Brevo client. |
| Razorpay | Payment processing | Checkout, payment, invoice, and payment confirmation data | India / vendor-controlled | Current | Maitro does not receive full card numbers. |
| Clerk | Authentication and session management | Identity, email, session tokens | US / vendor-controlled | Current | Used on authenticated surfaces. Public pages may set no cookies before sign-in. |
| Cal.com or Calendly | Office-hours scheduling | Calendar metadata and booking details | Vendor-controlled | Configured path varies | Book route supports provider-aware embeds. Avoid naming one exclusive provider in policy copy. |
| Sentry-compatible telemetry / GlitchTip | Error and performance telemetry | Error metadata, route, runtime context | Configured environment | Current when DSN configured | Telemetry should be scrubbed for personal data where practical. |
| Anthropic via internal AI proxy | Spotlight content assistance and internal drafting workflows | Limited non-PII content artifacts where configured | External dependency | Current for selected pipelines | Do not claim application content is used for model training. Do not send secrets or unnecessary PII. |
Conflict review is not perfect clearance.
Maitro can review submitted context against active and historical engagements, then recuse, carve out, or decline where needed. The process cannot guarantee employer IP clearance, and applicants may need independent counsel.
Incident handling follows law, contract, and policy.
- Detect and record the event
- Triage scope, systems, and data categories
- Contain affected access or infrastructure
- Assess legal, privacy, and customer impact
- Notify where required by law, contract, or policy
- Remediate root cause and preserve evidence
- Run a post-incident review where applicable
Responsible disclosure route
Email security@maitro.tech with reproduction steps and impact. Public researcher legal-protection, bug bounty, credit-page, or similar program language should not be shown unless counsel approves and the program is operational.
80-point gate as internal checklist
The quality gate is best described as an internal launch-readiness checklist unless automated evidence is published. It is not a certification or third-party audit.
FAQ
Security FAQ
Where is data hosted?
Maitro presents a primary India/Mumbai hosting posture, with limited sub-processors that may operate outside India. Do not interpret this as every byte staying in India.
Do you train AI on application content?
No public policy should say application content is used for model training. AI-assisted workflows must use minimized, non-secret content where configured.
Is SOC 2 live?
No. SOC 2 Type II should be treated as a planned or target control until a report is actually live.
How do I report a vulnerability?
Email security@maitro.tech with scope, reproduction steps, and impact. Do not include secrets, unrelated personal data, or public disclosure before triage.
Security and legal context
Route-safe next steps for review, application, trust, and policy context.
Security route
Report vulnerabilities directly.
Send security issues to the dedicated route with reproduction steps. Keep secrets out of reports unless necessary for triage.