Platform Security & Controls

Controls
Authentication

User sign-in is handled by Firebase Authentication (Google Identity Platform). Sign-in occurs through Firebase, and the server independently verifies the Firebase-issued JWT identity token before establishing an authenticated session.

• No user passwords are stored by Crossband.io. Credentials are held by Firebase; the platform keeps no password database, removing it as an attack surface.
• Every application and data endpoint enforces an authenticated session. Unauthenticated requests are rejected before any company data is read or written.
• Access is limited to authenticated business users. There is no anonymous or public access to company data.

Controls
Encryption

• In transit: all traffic is served over TLS / HTTPS (terminated by Google Cloud Run).
• At rest: the database (Google Cloud SQL) and document storage (Google Cloud Storage) are encrypted at rest by default by Google Cloud.
• Field-level: sensitive fields (for example, party and shareholder names) are additionally encrypted at the application layer using AES-256-CBC with an HMAC-SHA-256 integrity check (encrypt-then-authenticate). The encryption secret is held outside the public web root and is scoped per account.

Infrastructure
Hosting & Storage

Crossband.io runs entirely on Google Cloud: Cloud Run (application), Cloud SQL (database), and Cloud Storage (documents). Background processing runs through an authenticated internal job queue; there is no anonymous or public compute access.

That infrastructure is independently certified. Google Cloud maintains SOC 1 / SOC 2 / SOC 3, ISO/IEC 27001, 27017, 27018 and 27701, and ISO/IEC 42001 (AI Management Systems). The environment in which company data physically resides is therefore audited to those standards, even while Crossband.io's own application-layer attestation is in progress.

Candid
Current Status & Known Gaps

Stated plainly so a prospective user can weigh them. None of the items below involve training on customer data or public exposure of company data.

• SOC 2: not yet attested. A readiness program is underway. In the interim, assurance rests on this documented posture plus the certifications of the underlying Google Cloud infrastructure.
• Security hardening in progress: migration of legacy database access to fully parameterized queries (PDO) and the rollout of CSRF protections are active workstreams.
• Key management: field-level encryption keys are application-managed (held outside the web root) rather than in a dedicated key-management service (KMS/HSM).
• Content screening (in deployment): an automated acceptable-use screening layer over model inputs — with a logged review trail, and a designated individual who reviews flagged items and can intervene — is built and being deployed.

Assurance
For Prospective Users & Diligence

To let a lawyer or investor use Crossband.io responsibly today — ahead of SOC 2 — Crossband.io can provide:

• This platform-controls summary, together with the LLM Confidentiality Posture and LLM Confidentiality Environment documents.
• The underlying providers' SOC 2 / ISO reports (Anthropic and Google Cloud).

Recommended user practice: confirm you are authorized to input the data (client consent, or that an applicable NDA permits use of subprocessors).

Next: LLM Confidentiality Posture