Security - Cloakmint

Data Practices

How your event data is handled

Encryption at rest and in transit

All event data is encrypted at rest using AES-256. All communication between your environment and Cloakmint's API uses TLS 1.3. Encryption keys are managed separately from data storage.

Data residency

Customer event data is stored in US-East-1 by default. Enterprise customers can request data residency in EU-West-1 or AP-Southeast-1. Data does not leave the configured region for processing.

Retention and deletion

Default retention periods: Starter 30 days, Team 90 days, Enterprise custom. You can request full data deletion at any time. Deletion is completed within 30 days and confirmed in writing.

No training on customer data

Cloakmint's detection models are trained on synthetic and open-source datasets only. Your cloud event data is never used to train or improve models that serve other customers.

Access Controls

Least-privilege access by design

Cloakmint uses read-only IAM roles for all cloud integrations. We never request write or modify permissions on your cloud environment.

Internal Cloakmint employees follow a strict need-to-know policy. Customer data access requires manager approval and is logged and reviewed monthly. Access is revoked automatically when employment ends.

RBAC is available to all Team and Enterprise customers. Assign analyst roles, read-only reviewer roles, and admin roles independently per team member.

Read-only AWS IAM roles for all integrations
SAML 2.0 SSO (Team and Enterprise)
Multi-factor authentication enforced for all staff
API key scoping and rotation support
Audit logs of all analyst and admin actions

# Minimum required IAM policy for AWS integration
{
  "Version": "2026-10-17",
  "Statement": [
    {
      "Sid": "CloakmintReadOnly",
      "Effect": "Allow",
      "Action": [
        "cloudtrail:GetTrailStatus",
        "cloudtrail:DescribeTrails",
        "cloudtrail:LookupEvents",
        "guardduty:ListFindings",
        "guardduty:GetFindings",
        "securityhub:GetFindings",
        "ec2:DescribeFlowLogs"
      ],
      "Resource": "*"
    }
  ]
}

Infrastructure

Infrastructure security

Hosting

AWS (US-East-1 primary, multi-AZ)

Vulnerability management

Monthly dependency scans, quarterly pen test (external vendor)

Incident response

Documented IR runbooks, tabletop exercises twice yearly

Secrets management

AWS Secrets Manager, zero hardcoded credentials in codebase

Code review

Required 2-engineer review on all production changes

Uptime

99.9% SLA (Enterprise), status page at status.cloakmint.com

Compliance Posture

Building toward SOC2 Type II

In Progress

SOC2 Type II

Readiness assessment complete. Audit scheduled with external auditor. Expected completion Q4 2026.

Available

Data Processing Agreement (DPA)

GDPR-compliant DPA available for Enterprise customers. CCPA compliance posture documented. Contact [email protected].

Available

Security questionnaires

CAIQ (Cloud Assessment Initiative Questionnaire) and VSAQ completed. Available to Enterprise customers and prospects on request.

Report a vulnerability

We operate a responsible disclosure policy. If you believe you've found a security vulnerability in Cloakmint, please report it to our security team.

[email protected]

We acknowledge all reports within 24 hours and provide a resolution timeline within 5 business days.

We process security data. We hold ourselves to a high standard for it.