https://aegisgatesecurity.io/security/Recent content in Vulnerability Disclosure Policy on AegisGate — Secure Every AI InteractionHugo -- gohugo.ioen-usWed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/breach-notification/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/breach-notification/Breach Notification Policy Last updated: 2026-07-29 Policy owner: AegisGate Security, LLC Contact: security@aegisgatesecurity.io Our Commitment AegisGate Security, LLC is committed to transparency and timely notification in the event of a data breach. This policy describes: How to report a suspected breach to AegisGate How AegisGate notifies affected parties Our compliance with HIPAA, GDPR, and CCPA breach notification requirements Reporting a Breach to AegisGate Security Vulnerabilities If you believe you have discovered a security vulnerability in any AegisGate product, please see our Vulnerability Disclosure Policy for reporting instructions.https://aegisgatesecurity.io/security/data-disposal/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/data-disposal/Data Disposal Policy Version: 1.0 Owner: AegisGate Security, LLC Review Cycle: Annual (next review: Q3 2027) Contact: security@aegisgatesecurity.io 1. Purpose This policy defines how AegisGate Security, LLC classifies, retains, and disposes of data across all lifecycle phases. It supports compliance with SOC 2 Confidentiality criteria (C3.1), HIPAA (45 C.F.R. § 164.530(j)), GDPR Article 17 (Right to Erasure), and CCPA/CPRA deletion requirements. 2. Data Classification Classification Description Examples Retention Critical Data whose loss or unauthorized access would cause severe harm Encryption keys, license signing keys, audit log chains Indefinite (until customer deletion request) Confidential Data protected by regulation or contract PHI, PII, payment data, authentication credentials Duration of contract + regulatory minimum Internal Data for internal operations, not public Configuration files, session state, performance metrics 90 days (default) to 1 year (configurable) Public Data intended for public access Documentation, website content, open-source code Indefinite (version-controlled) 3.https://aegisgatesecurity.io/security/dr-test/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/dr-test/Disaster Recovery Test Report Test Date: 2026-07-29 Test Type: Full Platform Recovery Test Scope: AegisGate Security Platform v4.2.0 Test Environment: Clean Docker host (Ubuntu 22.04 LTS) Result: ✅ PASSED — All RTO targets met Owner: AegisGate Security, LLC Next Test Date: Q4 2026 1. Test Objectives Validate AegisGate Security Platform disaster recovery procedures against documented RTO/RPO targets: Objective Target Result Container deployment and startup 15 minutes ✅ 11 minutes Configuration restoration 30 minutes ✅ 18 minutes License reactivation 5 minutes ✅ 2 minutes Compliance engine warm-up 2 minutes ✅ 1.https://aegisgatesecurity.io/security/incident-response-sla/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/incident-response-sla/Incident Response Service Level Agreement Field Value Document Version 1.0 Owner Security Operations, AegisGate Security, LLC Review Cycle Quarterly Last Reviewed July 29, 2026 Next Review October 29, 2026 Classification Internal & Customer-Facing 1. Purpose This document defines the formal service level agreements (SLAs) governing AegisGate Security, LLC’s incident response operations. It establishes severity-based response targets, escalation procedures, and accountability standards to ensure timely, consistent, and transparent handling of security incidents across all AegisGate products and services.https://aegisgatesecurity.io/security/processing-integrity/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/processing-integrity/Processing Integrity Controls Version: 1.0 Owner: AegisGate Security, LLC Review Cycle: Annual (next review: Q3 2027) Contact: security@aegisgatesecurity.io 1. Purpose This document describes the processing integrity controls implemented in AegisGate Security Platform, mapping to SOC 2 Trust Services Criteria for Processing Integrity (PI1). Processing integrity addresses whether system processing is complete, valid, accurate, timely, and authorized. 2. Processing Integrity Principles Principle Definition AegisGate Control Completeness All processing steps execute without omission Fail-closed architecture — if any check fails, the request is rejected Validity Processing follows defined business rules 1,457 compliance controls validate rules at runtime Accuracy Processing produces correct results Hash-chained audit logs verify output integrity Timeliness Processing occurs within defined timeframes Per-tier rate limiting ensures timely processing Authorization Processing is initiated by authorized parties RBAC + MFA + OIDC/SAML enforce authorization 3.https://aegisgatesecurity.io/security/rto-rpo/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/rto-rpo/Recovery Time and Point Objectives Version: 1.0 Owner: AegisGate Security, LLC Review Cycle: Annual (next review: Q3 2027) Contact: security@aegisgatesecurity.io Overview This document defines AegisGate Security Platform’s Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for each deployment component. These targets support SOC 2 Availability criteria, HIPAA contingency planning requirements (45 C.F.R. § 164.308(a)(7)), and business continuity planning. AegisGate is a self-hosted, on-premises security gateway. Infrastructure recovery is the customer’s responsibility.https://aegisgatesecurity.io/security/training/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/training/Security Awareness Training Program Version: 1.0 Owner: AegisGate Security, LLC Review Cycle: Annual (next review: Q3 2027) Contact: security@aegisgatesecurity.io 1. Purpose This program defines AegisGate Security, LLC’s security awareness training requirements. It satisfies: HIPAA Security Rule § 164.308(a)(5) — Security Awareness Training SOC 2 Common Criteria CC1.3 — Training and Awareness ISO 27001 A.6.3 — Awareness, Education, and Training 2. Training Requirements 2.1 Required Training Modules Module Frequency Target Audience Duration Delivery Security Awareness Foundations Annual All personnel 60 min Self-paced Secure Development Practices Annual Engineering 90 min Self-paced Incident Response Procedures Annual All personnel 45 min Self-paced HIPAA Privacy and Security Annual All personnel with PHI access 60 min Self-paced SOC 2 Compliance Overview Annual All personnel 30 min Self-paced Phishing and Social Engineering Quarterly All personnel 15 min Simulated exercise Secure Configuration Management Annual Engineering 45 min Self-paced Vendor Security Awareness Annual Procurement, management 30 min Self-paced 2.https://aegisgatesecurity.io/security/training-records/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/training-records/Security Training Completion Records Version: 1.0 Owner: AegisGate Security, LLC Review Cycle: Quarterly Contact: security@aegisgatesecurity.io Completion Records Training completions are documented per the Security Awareness Training Program. Individual assessment records are available upon request under NDA. 2026 — Annual Training Cycle ID Module Assigned Roles Completion Deadline Status Completed Assessed By TRN-2026-001 Security Awareness Foundations All personnel 2026-08-29 ✅ Completed 2026-07-29 Security Lead TRN-2026-002 Secure Development Practices Engineering 2026-08-29 ✅ Completed 2026-07-29 VP Engineering TRN-2026-003 Incident Response Procedures All personnel 2026-08-29 ✅ Completed 2026-07-29 Security Lead TRN-2026-004 HIPAA Privacy and Security All personnel with PHI access 2026-08-29 ✅ Completed 2026-07-29 Security Lead TRN-2026-005 SOC 2 Compliance Overview All personnel 2026-08-29 ✅ Completed 2026-07-29 VP Engineering TRN-2026-006 Phishing and Social Engineering All personnel Quarterly ✅ Completed 2026-07-29 Security Lead TRN-2026-007 Secure Configuration Management Engineering 2026-08-29 ✅ Completed 2026-07-29 VP Engineering TRN-2026-008 Vendor Security Awareness Procurement, management 2026-08-29 ✅ Completed 2026-07-29 VP Engineering 2026 — Quarterly Phishing Simulations Quarter Simulation Sent Clicked Reported Click Rate Report Rate Result Q3 2026 Baseline assessment — — — Pending Pending Scheduled 2026-09 Q4 2026 Follow-up — — — Pending Pending Scheduled 2026-12 Assessment Results Minimum passing score: 80%https://aegisgatesecurity.io/security/vendor-risk/Wed, 29 Jul 2026 00:00:00 +0000https://aegisgatesecurity.io/security/vendor-risk/Vendor Risk Assessment Field Value Document Version 1.0 Owner Security Operations, AegisGate Security, LLC Review Cycle Annual Last Reviewed July 29, 2026 Next Review Q3 2027 Classification Internal & Customer-Facing 1. Purpose This document provides a comprehensive risk assessment of all third-party vendors and subprocessors engaged by AegisGate Security, LLC. It evaluates each vendor’s security posture, data handling practices, and associated risks in accordance with AegisGate’s vendor risk management framework and applicable data protection regulations.