What runs where, what protects it, and what isn't built yet.

What runs where

Everything runs in AWS, in a single region (us-east-1), inside a dedicated VPC. Application services run on ECS Fargate inside private VPC subnets with outbound egress only; the database is RDS PostgreSQL 16, also private. The application your experts work in runs as its own service against its own database — a separate database on the same instance, not a shared schema — so expert judgments are not co-mingled with platform records.

Your task specs and clips live only in S3. Public access is blocked on every bucket, and every read and write goes through a short-lived presigned URL rather than a public object URL: fifteen minutes to write, five minutes to read on the platform buckets, and a read-only fifteen-minute grant scoped to a single object for media shown to experts. Every public hostname is TLS with HTTP redirected to HTTPS, database connections are encrypted, and each service sits behind its own health-checked load balancer.

On production the two services on the judgment path each run two tasks across availability zones, so one task can drain or redeploy without downtime, and the database is Multi-AZ with automatic failover.

Certifications

Read this one carefully, because the honest answer has two halves and vendors usually publish only the first.

Backup, restore and service posture

The production database takes automated daily snapshots with 14-day retention, and supports point-in-time recovery across the same window with transaction logs shipped every five minutes. Snapshots are encrypted with the instance's key.

Restore drills run 2026-08-28. Restoring the newest automated snapshot produced an available instance in roughly 6 minutes; a point-in-time restore produced an available, schema-intact instance in roughly 27 minutes. Each drill restored into a throwaway instance in the same subnet group and security group, proved the restored schema from inside the VPC, and deleted the throwaway afterwards. The live database was never touched. A real recovery adds repointing the services, about fifteen minutes.

Object data has its own protections: the uploads and media buckets are versioned and TLS-only, the audit anchors sit under Object Lock (not deletable early, even by us), and versioning keeps prior versions of evidence artefacts until an explicit purge.

Rebuilding the whole environment from the repository is scripted, but it has not yet been timed end to end, so we do not quote a figure for it.

These are measurements, not commitments. For the pilot, DeepenSkill is operated on a best-effort basis. This page describes the architecture and publishes what has actually been measured; it does not commit to numeric availability, recovery or response-time targets. Scheduled maintenance is announced at least 24 hours ahead. Incidents are worked by the DeepenSkill team during US Pacific business hours, best effort. The one timing commitment that is contractual is security-incident notification, below.

An audit trail you can check yourself

Every operator, lab, partner and expert action lands in an append-only, hash-chained audit log. The chains are anchored hourly into an S3 bucket under Object Lock in governance mode with a one-year retention — anchors cannot be deleted early, including by us — and update and delete are revoked on those tables at the database-role level and again by trigger. Both production chains verified with no seam on 2026-08-28.

Released evidence packs are signed with ES256 using a dedicated key and carry a readable manifest. Verification is something you run, not something you take from us: the verification scripts recompute the pack hash and check the signature against the published public key on your own machine, with no dependency on our dashboard. At the account level, CloudTrail records API activity across regions with log-file validation on.

See how the evidence pack is produced →

Incident response

Security incidents and suspected breaches go to skill@deepen.ai, which is also the address our production alarms notify.

Our DPA commits us to notifying you without undue delay and in any event within 48 hours of becoming aware of a confirmed personal-data breach affecting your data — deliberately tighter than the 72-hour outer bound in GDPR Article 33, so your own regulatory clock keeps some room. The notification describes, so far as it is then known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

FAQ

• Is DeepenSkill SOC 2 certified?

  Not on its own. Deepen AI, the parent company, holds SOC 2 Type II, ISO 27001 and TISAX company-wide, with a GDPR-aligned data-protection posture. DeepenSkill is being added to that existing program rather than certified separately. There is no DeepenSkill-specific SOC 2 or TISAX report today, and we will not represent one until that scope extension is complete.

• Do you support SSO, MFA and SCIM?

  Not yet. Sign-in today is email and password, or Google. Enterprise SSO and SAML or OIDC federation, multi-factor authentication and SCIM user lifecycle are decided in principle and not built, with no committed date. We state the same thing to users inside the product.

• Where does our task material live, and who can see it?

  In AWS, in a single region (us-east-1), inside a dedicated VPC. Task specs and clips live only in S3, with public access blocked on every bucket and every read and write through a short-lived presigned URL rather than a public object URL. Application services and the databases run in private subnets. Your material is seen by our operators, the experts assigned to your project, and you.

• Do your sourcing partners see our task material?

  No, unless you separately agree in writing to an arrangement where they do. Sourcing partners handle expert records — identity, credentials and payment detail — not your task material. In the other direction, partner organisation names and expert identities are stripped from every lab-facing field by a redaction function in code.

• What availability and recovery targets do you commit to?

  For the pilot, none numerically. DeepenSkill is operated on a best-effort basis: we describe the architecture and publish what we have actually measured rather than committing to availability, recovery or response-time numbers. The one contractual timing commitment is security-incident notification within 48 hours.

• Can we get your DPA and a completed security questionnaire?

  Yes. Email skill@deepen.ai and we will send the DPA and the full security overview. That overview names every control, cites the infrastructure that implements it, and states plainly what is live, what is being hardened and what does not exist yet.

Request the DPA or a security questionnaire

Send us the questionnaire you use and we will answer it against this same list — including the rows where the answer is "not yet". If you would rather start from ours, ask for the security overview and the DPA and we will send both.