What the architecture does for your security, and what we have not yet had independently assessed.
This document is a working draft published for transparency while Haivian Technology prepares for launch. It has not yet been reviewed by qualified counsel and is not a contract. Items still awaiting a decision are marked as open below. Online purchasing stays closed until these are settled and approved.
The smallest attack surface is the one that does not exist. In the current local deployment your project content and provider credentials stay on your machine, so there is no Haivian Technology-side store of customer source material to breach.
Provider API keys are held by you and used by software running on your device. Haivian Technology does not proxy your model traffic and does not hold your provider credentials.
Capabilities are granted explicitly and default deny. Actions are recorded with the authority under which they happened, which makes after-the-fact review possible rather than speculative.
Haivian Technology holds no security certification and makes no compliance claim. There has been no third party penetration test and no formal audit of the products described on this site.
We would rather say that plainly than let a reader infer otherwise from a page like this one.
Open item. External penetration testing and formal audit are not yet commissioned.
If you find a security issue, write to the address below with enough detail to reproduce it. We will acknowledge it and tell you what we intend to do.
Open item. Coordinated disclosure timeline is not yet published.
The following response headers are required in production and are configured at the web server, not in this static build: Strict-Transport-Security, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, X-Frame-Options DENY or frame-ancestors none, and Permissions-Policy denying camera, microphone and geolocation.
A Content-Security-Policy is intended but is not yet enforced, because this build uses inline styles and inline JSON that a strict policy would break. Applying one requires either hashing those inline blocks or moving them out first.
Questions about any of this: hello@haivian.com. Operated by Qonduit Limited, New Zealand.