Compliance
Does Cellect have a SOC 2 report?
PendingCellect is preparing for an initial SOC 2 Type I examination of Cellect Fi and its supporting production systems. No report has been issued.
Operations
Who operates Cellect?
CurrentCellectAI Inc. Privileged access is limited, and break-glass credentials and backup-decryption keys are held in escrow for recovery.
Has Cellect had a confirmed product security breach?
None knownCellect is not aware of any confirmed unauthorized access to customer data in its product environment. Security events and suspected incidents are tracked under the incident-response process.
Infrastructure
Where are Cellect products hosted?
CurrentHosted in New Jersey, with an encrypted off-site copy in Microsoft Azure.
How is physical access restricted?
CurrentPhysical access to production equipment is restricted; entry is keypad-controlled and visitors are escorted.
Does Cellect back up customer data?
CurrentCellect Fi database and server backups are encrypted and monitored. A separate encrypted copy in Microsoft Azure has locked retention, and restores are tested. Full-service recovery time is not claimed.
How is service availability monitored?
CurrentCellect monitors public endpoints, service and infrastructure health, backup freshness, and scheduled-job invocation.
Access control
How is customer access separated?
CurrentCellect Fi applies organization, company, project, and capability-level authorization.
How are users authenticated?
CurrentUsers sign in through a centralized identity provider; sessions expire and can be revoked.
Data protection
Is data encrypted in transit and at rest?
CurrentPublic traffic uses HTTPS and database connections require TLS. Production disks and document storage are encrypted at rest, backups are encrypted before leaving the host, and selected sensitive fields have additional application-level encryption.
AI and data
Is customer data used to train AI models?
CurrentCellect Fi's AI features use Google, OpenAI, and Anthropic. Groq provides content-safety screening and transcription for the workflows that use them, and is a last backup for short text rewriting. These providers' commercial terms do not use API inputs and outputs for model training by default. Other providers are listed by data use on the Subprocessors page. Cellect does not claim ZDR; limited provider safety or abuse-monitoring retention may apply.
Application security
How can a vulnerability be reported?
CurrentResearchers and customers can report suspected vulnerabilities privately to security@cellect.ai. Cellect requests good-faith testing that avoids privacy violations, service disruption, and access to data belonging to others.
How are Cellect product changes controlled?
CurrentProduct changes are version-controlled. Automated checks run on new revisions of the main branch, and each production deployment is recorded and reviewed.
Have Cellect products completed an independent penetration test?
In progressAn independent Cellect Fi application assessment is in progress. No independent test report is currently available.
Control inventory
| Control | SOC 2 criteria | Status | Cadence | Evidence maintained |
|---|---|---|---|---|
| GOV-01Owner security oversight | CC1, CC2 | Implemented | Quarterly | Quarterly security review; Risk register |
| GOV-02Policy approval and review | CC1, CC2 | Implemented | At least annually | Policy manifest; Approved policy snapshots |
| RISK-01Security risk assessment | CC3, CC4, CC9 | Implemented | At least annually | Risk register; Risk treatment decisions |
| ASSET-01System and device inventory | CC2, CC5 | Implemented | Quarterly | Asset inventory; Administrative endpoint inventory; Server hardening review |
| ACCESS-01Customer authorization | CC6 | Implemented | Continuous | Authorization tests; Membership and grant records |
| ACCESS-02Privileged access restriction | CC6 | Implemented | Quarterly review | Privileged account register; Administrative access logs; Privileged access review |
| ACCESS-03Multi-factor authentication | CC6 | Implemented | Continuous | Identity-provider enforcement screenshots; Authentication configuration; Privileged access review |
| ENDPOINT-01Administrative endpoint hardening | CC6, CC7 | Implemented | Continuous | Device-management and disk-encryption evidence; Patch and endpoint-protection status; Server hardening review |
| CHANGE-01Version-controlled application changes | CC8 | Implemented | Per change | Git history; Test and build output |
| CHANGE-02Production deployment record | CC8 | Implemented | Per deployment | Deployment logs; Release record |
| VULN-01Dependency and secret scanning | CC7, CC8 | Implemented | Per change / weekly | Dependency scan; Secret scan; Remediation tickets |
| VULN-02Independent application assessment | CC4, CC7 | In progress | At least annually | Penetration-test report; Retest evidence |
| LOG-01Security-relevant logging and review | CC4, CC7 | Implemented | Continuous / weekly review | Application logs; Administrative access logs; Review record |
| IR-01Incident identification and response | CC7 | Implemented | Per event / annual exercise | Incident register; Tabletop record |
| BC-01Encrypted backup and restore testing | CC7, CC9 | Implemented | Scheduled backup / quarterly restore | Backup logs; Restore-test record; Virtual-machine backup reconciliation; Off-site recovery exercise; Key-escrow recovery test |
| BC-02Off-site backup copy | CC7, CC9 | Implemented | Daily / annual recovery exercise | Cloud replication logs; Off-site restore test; Owner-approved RPO/RTO |
| VENDOR-01Vendor inventory and security review | CC3, CC9 | Implemented | On onboarding / annually | Vendor register; Provider assurance documents |
| DATA-01Data classification and retention | CC2, CC6 | Implemented | Continuous / annual review | Data inventory; Retention schedule; Deletion records |
| CRYPTO-01Encryption and key management | CC6 | Implemented | Continuous / annual key review | TLS scan; Storage encryption inventory; Key rotation record |
| PHYS-01Physical access restriction | CC6 | Implemented | Continuous / quarterly review | Authorized access record; Physical security inspection; Visitor and maintenance register; Environmental protection inspection |
| AI-01AI provider and retention governance | CC2, CC3, CC9 | Implemented | On change / annually | Model route inventory; Provider terms; Retention configuration |