Teramot — Compliance & Security
Trust center
Security you can verify, not just trust
Teramot holds a SOC 2 Type II report with no exceptions, issued in August 2026 by Sentry Assurance after a six-month observation period. This page explains how the platform is protected, what backs each control, and where to find the evidence.
SOC 2 Type IISentry Assurance · Aug 20266
Months of Type II observation
0
Exceptions
15 / 15
Pentest findings fixed
365
Days of log retention
Certifications and reports
SOC 2 Type II
Report issued · Aug 2026An independent auditor tested Teramot's controls against the AICPA Trust Services Criteria for Security over six months, and found them operating effectively throughout, with no exceptions. A Type II report covers how controls actually ran over time, not only how they were designed.
- Auditor
- Sentry Assurance (U.S.)
- Criteria
- Security · Common Criteria CC1–CC9
- Observation period
- 16 Dec 2025 – 15 Jun 2026
- Access
- Under NDA, on request
SOC 2 Type I
Completed · Dec 2025Teramot's first SOC 2 report: the same auditor assessed the design of the Security controls at a point in time.
- Auditor
- Sentry Assurance (U.S.)
- Type
- Point in time
Penetration test
All findings fixedAn independent firm attacked the platform the way an adversary would. It identified 15 vulnerabilities; all of them have been remediated.
- Tester
- Faraday Sec (Argentina)
- Cadence
- At least once a year
ISO/IEC 27001
In preparationDocumentation and evidence for the information security management system are in progress, synced continuously through Vanta.
- Target
- 2026
- Tooling
- Vanta
Data protection law
OngoingPersonal data is handled under Argentina's Personal Data Protection Law, with an annual review.
- Framework
- Law 25.326 (Argentina)
- Review
- Annual
SOC 2 is an attestation, not a certificate: the auditor’s opinion, the description of the system and every control tested are in the report itself, which we share under NDA (see below).
What the SOC 2 audit covered
The Security category, also called the Common Criteria, is the mandatory core of every SOC 2 report. It has nine groups. This is what each one means at Teramot, and the policy that governs it.
A code of conduct, defined security roles, and an Information Security Committee that approves policies.
Security roles →Published security commitments and policies, and open channels to report vulnerabilities or concerns.
Security commitments →A documented process to identify threats, rate them and track their treatment.
Risk management →Vanta tests the controls against the infrastructure continuously and flags any drift for remediation.
Operations security →Policies turned into enforced technical controls: permission checks in the API, infrastructure as code, automated checks on every change.
Information security policy →SSO with MFA and a VPN for staff, role-based access for customers, encryption at rest and in transit.
Access control →Audit trails, threat detection, alerting, and an incident response plan tested at least once a year.
Incident response →Every change through a pull request with automated tests and security checks, promoted from development to staging to production.
Secure development →Vendor due diligence, plus business continuity and disaster recovery plans.
Third-party management →Defense in depth
Controls are layered so that no single failure exposes customer data. From the public edge of the platform to the data itself:
Data protection
| Area | How it is protected |
|---|---|
| Encryption in transit | TLS 1.2 at a minimum and TLS 1.3 supported on every public endpoint, with HTTP redirected to HTTPS. Production load balancers use AWS’s FIPS security policy with hybrid post-quantum key exchange. The message bus between services requires TLS, and internal control-plane calls use mutual TLS. |
| Encryption at rest | AES-256 in object storage (Amazon S3), the metadata database (Amazon Aurora PostgreSQL) and storage volumes. |
| Customer isolation | Each project has its own database in the data catalog and its own storage prefix. Every query is parsed before it runs, and any reference outside the project, unless the data was explicitly shared with it, is rejected. See Where your data lives. |
| Source systems | Teramot only reads from your sources, and a read-only database user is recommended. Private connections over IPsec are available. |
| Source credentials | Encrypted at rest, used only when connecting, never returned by the API, and scrubbed from logs and error reports. |
| Residency | AWS us-east-1 (N. Virginia). Customer data is not replicated to other regions. |
| Artificial intelligence | Teramot does not train or fine-tune models on your data. What each agent receives, and which providers process it, is in AI agents. |
| Retention | Infrastructure logs 365 days, project activity log 90 days, agent traces 14 days, metadata backups 7 days. See Retention and deletion. |
Secure development lifecycle
Every change to the product follows the same path to production:
- BranchWork starts on its own branch. The main branch cannot be force-pushed or deleted.
- Pull requestCode merges only through a pull request, with linear history and every review thread resolved.
- Automated checksTests, type checks and linters with security rules (gosec, Bandit), plus secret scanning on the core application.
- Security reviewA required automated review with a security checklist: credentials, input validation, sensitive data in logs.
- StagingInfrastructure is code (Terraform). Changes reach development and staging before production.
- ReleaseProduction runs only versioned releases tagged on signed commits, deployed with short-lived credentials.
Container images are scanned for vulnerabilities when they are pushed, and features can be switched off at runtime without a redeploy.
Monitoring and incident response
| Signal | Coverage |
|---|---|
| Cloud audit trail | AWS CloudTrail across every region, with log-file integrity validation |
| Network | VPC Flow Logs on all production traffic |
| Threat detection | Amazon GuardDuty, with findings routed to the security team |
| Application | Error monitoring with secrets scrubbed, a correlation ID on every request, and alarms on errors, latency and database health |
| Endpoints | Bitdefender GravityZone on staff devices |
| Compliance | Vanta tests the controls continuously |
When something does happen, the Incident Response Plan sets the steps:
- DetectAlerts from the monitoring above, or a report to security
@teramot.com. - TriageEach incident gets a severity from P0 to P3, which sets its urgency.
- Contain and fixCybersecurity and DevOps isolate the cause and remediate it.
- NotifyAffected customers hear from us within 72 hours of confirmation.
- LearnA written post-incident report. The root-cause analysis is shared under NDA.
The plan is tested at least once a year.
Vulnerability management
Findings from scans, monitoring and penetration tests are fixed within these deadlines, set in the Operations Security Policy:
External vulnerability scans run every quarter, and an independent penetration test at least once a year.
Business continuity
The Business Continuity and Disaster Recovery Plan sets these recovery targets for the production platform:
1
Hour to recover (RTO)
15
Minutes of data at risk (RPO)
| Area | Detail |
|---|---|
| Database backups | Automated, kept 7 days, with point-in-time recovery and a final snapshot before any deletion |
| Availability | A database replica in a second availability zone, and deletion protection |
| Stateful hosts | Daily volume snapshots |
| Testing | Restores are tested at least once a year |
Compliance timeline
Compliance & Security pack published
Oct 2025Version 1.0 of this page and the policy set
SOC 2 Type I completed
Dec 2025Sentry Assurance · Security criteria
Type II observation period
Dec 2025 – Jun 2026Six months of controls tested in operation
SOC 2 Type II report issued
Aug 2026No exceptions
ISO/IEC 27001
Target 2026Documentation and evidence in progress
Tools behind the controls
Company and governance
| Item | Detail |
|---|---|
| Legal name | Halley LLC |
| Headquarters | Rosario, Argentina |
| U.S. entity | Registered in Delaware |
| Registered address | 16192 Coastal Highway, City of Lewes, County of Sussex, DE 19958 |
| Countries served | Argentina · United States |
| Information Security Committee | Bruno Ruyu · Lucas Uzal · Leandro Ruspini · Ezequiel Alejandro Mora · Valentín Torassa Colombero |
| Policy approval | Approved by Valentín Torassa Colombero, Cybersecurity Analyst |
The companies that process data on Teramot’s behalf are listed in Providers that process data. Sentry, the error-monitoring service there, is unrelated to Sentry Assurance, the SOC 2 auditor.
Documents and policies
SOC 2 Report Access
Need the SOC 2 Type II report?
We share the full report, including the auditor's opinion and the controls tested, under NDA. Write to security@teramot.com and tell us which organization it is for.
Revision history
| Date | Author | Role | Notes |
|---|---|---|---|
| Oct 2025 | Valentín Torassa Colombero | Cybersecurity & Compliance Analyst | Initial release of the Teramot Compliance & Security Pack |
| Oct 2026 | Valentín Torassa Colombero | Cybersecurity & Compliance Analyst | SOC 2 Type II report issued (August 2026, Sentry Assurance, no exceptions); page redesigned with technical detail on each control |