Controls described without overclaiming.

Cellect is preparing for an initial SOC 2 Type I examination scoped to Fi and the systems that support its production operation. No report has been issued yet, and Cellect does not represent itself as SOC 2 compliant or certified.

CellectAI Inc is currently owner-operated with no employees or contractors holding production access. Controls are designed for that actual operating model rather than assuming a larger security organization.

Cellect is not aware of any confirmed unauthorized access to Fi customer data. Security events and suspected incidents are tracked under the incident-response process.

Fi runs on Cellect-managed infrastructure in a restricted-access United States office environment. Detailed network and physical-location information is shared only when appropriate during a security review.

The office is protected by keypad access. Production equipment and access credentials are controlled by Cellect's owner, the only person currently authorized for physical or administrative access.

Fi database backups are encrypted and restore-tested. Cellect is adding a separately located encrypted copy before selecting the SOC 2 Type I examination date.

Fi applies organization, company, project, and capability-level authorization. A user without an explicit resource grant cannot view that resource, and administrative routes require elevated authorization.

Fi uses centralized identity through Cellect's identity provider and short-lived application sessions. Administrative access is distinct from ordinary customer access.

Public Fi and trust-center traffic is encrypted with HTTPS. Internal service paths are being inventoried as part of SOC 2 readiness, so Cellect does not yet claim universal transport encryption between every internal component.

Cellect encrypts backups and uses application-level encryption for selected high-risk fields. A complete storage-encryption inventory is in progress; detailed claims are withheld until that verification is complete.

Cellect uses commercial API services from Anthropic, Google, and OpenAI. Their standard commercial terms do not use API inputs and outputs for general model training unless a customer opts in. Cellect has not yet verified zero-data-retention status and therefore does not claim ZDR; limited provider safety or abuse-monitoring retention may apply.

Researchers and customers can report suspected vulnerabilities privately to security@cellect.ai. Cellect requests good-faith testing that avoids privacy violations, service disruption, and access to data belonging to others.

Fi changes are version-controlled and subject to automated type, lint, and test checks. Cellect is formalizing production change records and deployment approvals for its owner-operated model before the Type I examination date.

An independent Fi penetration test is planned as part of the readiness program. No completed test report is currently available.