Security & residency.
What we have today. What we don't. What we're building toward. The honest line by line — written for the procurement officer who is going to print this and attach it to a vendor review.
Posture at a glance.
Encryption in transit.
All customer-facing endpoints (web, API, MCP) require TLS 1.3 minimum. We do not negotiate down to TLS 1.2 except on legacy-OS clients explicitly enabled by per-tenant policy. Cloudflare terminates TLS at the edge for the marketing site; the inference endpoint terminates on the iShard control plane behind Tailscale.
Internal node-to-node traffic runs over WireGuard on the Tailscale mesh. Keys are rotated on tailnet membership change. No internal traffic crosses the public internet unencrypted at any point.
Encryption at rest.
Production volumes that may carry customer state (model checkpoints uploaded for Dedicated/Private tiers, fine-tune data, KV cache snapshots) live on LUKS / dm-crypt encrypted block devices. Disk-level keys are held in hardware-protected storage on the host; not synced to any external KMS.
Key rotation is performed manually on rotation events (host re-imaging, key compromise indicators). An automated KEK rotation policy is on the roadmap; the gap is disclosed here rather than papered over.
Data residency.
All inference traffic is processed and stored in Tampa, Florida, USA. There are no foreign sub-processors in the inference path. Cloudflare is the only edge sub-processor and is used for the public marketing site, not the inference plane.
Private Fleet contracts write US-only residency into the contract explicitly. If a customer requires written attestation of US residency for procurement or regulatory reasons, that is the tier and the document.
Customer payload usage.
iShard does not use customer payloads for training, fine-tuning, model improvement, or any purpose beyond serving the inference request that produced them. Specifically:
- Prompts and completions are not retained beyond the active session debug window (default: 60 seconds for diagnostics, then dropped).
- Customer-uploaded checkpoints are isolated per-tenant and scrubbed within 24 hours of reservation expiry.
- Fine-tune data passed through is processed in-memory; no persistent storage of training corpora.
This is also stated in ai.txt under no-customer-data-training: yes.
Incident response.
Single-operator pager. Initial triage commits:
- Private Fleet: 4-hour first-response, 24/7. Phone provisioned at signing.
- Dedicated Shard: 1-hour pager response for incidents lasting >5 minutes inside reserved windows.
- Open Shard: best-effort. Status page (status.ishard.us when live, Q3 2026) is the canonical channel.
Post-incident reports issued within 5 business days for any incident lasting >15 minutes on Dedicated/Private tiers. Reports include root cause, customer-visible impact, and remediation.
Data deletion.
On reservation expiry or contract termination:
- Customer-loaded model checkpoints, KV cache, in-memory state: scrubbed within 24 hours.
- Audit log entries: retained 90 days for security telemetry, then deleted.
- Billing records: retained 7 years (US tax requirement).
Out-of-band deletion requests (faster than the default 24-hour scrub, or for billing records where legally permissible) are accepted at hello@ijarvis.ai with subject iShard data deletion. Verified within 5 business days.
Vulnerability disclosure.
Responsible disclosure encouraged. Email hello@ijarvis.ai with subject iShard security disclosure. We commit to:
- Acknowledging receipt within 48 hours.
- Initial assessment within 5 business days.
- Public coordinated disclosure within 90 days, sooner if patched.
No bug-bounty cash today. We will credit researchers in the change log of the affected component if the report is actionable.
Sub-processors.
- Cloudflare — DNS, edge TLS termination, Pages hosting for the marketing site. Not in the inference data plane.
- Tailscale — control plane for the WireGuard mesh. No customer payload crosses Tailscale; only mesh metadata.
- Stripe — payment processing. Card data never touches iShard infrastructure.
- Google Fonts — used by the marketing site only. Not in the inference plane.
Compliance roadmap.
- Q3 2026: Status page live with real fleet telemetry; control-plane GA; written incident-response runbook published.
- Q4 2026: Multi-site colo for Private Fleet; written multi-site failover SLA terms.
- 2027: SOC 2 Type 1 audit (target Q2). HIPAA BAA template ready for customer demand. Reviewed KMS-backed key rotation policy.