{"product":"ThumbGate","updated":"2026-08-18","certification":false,"copyPasteUrl":"https://thumbgate.ai/security.json","htmlUrl":"https://thumbgate.ai/security","items":[{"id":"what","question":"What does ThumbGate do?","answer":"ThumbGate is a local-first pre-action control layer for AI coding agents. Gates can allow, warn, require approval, or hard-deny tool calls. It is not a guarantee that every unsafe action is detected.","source":"/security and docs/legal/SECURITY_AND_INCIDENT.md"},{"id":"soc2","question":"Do you have SOC 2, ISO 27001, ISO 42001, HIPAA, or a default BAA?","answer":"No. ThumbGate does not have a SOC 2 Type I/II report, ISO 27001 or ISO 42001 certificate, HIPAA eligibility, or a default BAA. Do not treat marketing “control mapping” language as an attestation.","source":"docs/legal/SECURITY_AND_INCIDENT.md §7"},{"id":"source-code","question":"Where does customer workspace source code live?","answer":"On the customer machine by default. The local engine does not fetch or render workspace source on public marketing dashboards. Hosted surfaces process account, billing, pairing, and runner operational logs — not local workspace contents unless the customer sends them.","source":"/privacy and docs/legal/PRIVACY_POLICY.md §1–2"},{"id":"training","question":"Do you train models on customer data?","answer":"We do not share local-engine workspace source with model trainers. Hosted features only process content the customer sends to those features.","source":"docs/legal/PRIVACY_POLICY.md §3"},{"id":"subprocessors","question":"Who are your subprocessors?","answer":"Operational list: Stripe (payments), Railway (hosting), Plausible (web analytics), PostHog (product analytics where configured), Resend (transactional email where configured), PayPal (alternate payment rail where used), GitHub (repo/issues/Marketplace). Presence on the list is not a claim that every enterprise questionnaire or SCC is complete.","source":"docs/legal/PRIVACY_POLICY.md §4"},{"id":"encryption","question":"Is data encrypted in transit?","answer":"Hosted endpoints are served over HTTPS/TLS. This is engineering practice, not a certified control.","source":"docs/legal/SECURITY_AND_INCIDENT.md §3"},{"id":"auth","question":"How is hosted access controlled?","answer":"Sensitive hosted routes use API keys or operator auth. Stripe webhooks are HMAC-verified. Production secrets live in the host secret store, not git.","source":"docs/legal/SECURITY_AND_INCIDENT.md §3"},{"id":"audit","question":"What audit artifact exists for a consequential agent action?","answer":"A signed broker execution receipt. Agents cannot mint a valid signature. Public schema: https://github.com/IgorGanapolsky/ThumbGate/blob/main/config/schemas/broker-execution-receipt.schema.json","source":"docs/BROKER_EXECUTION_RECEIPTS.md"},{"id":"gpc","question":"Do you honor Global Privacy Control, DNT, and CCPA 1798.135?","answer":"Yes on marketing surfaces. Sec-GPC: 1 or DNT: 1 discards first-party /v1/telemetry/ping (still 204) and omits Plausible/GA bootstrap. Privacy notice describes analytics as pseudonymous, not anonymous, and exposes Your Privacy Choices.","source":"/privacy#your-privacy-choices and PR #3514"},{"id":"sale","question":"Do you sell personal information?","answer":"No.","source":"docs/legal/PRIVACY_POLICY.md §2"},{"id":"deletion","question":"How do we delete hosted account data?","answer":"Email privacy@thumbgate.ai or the contact on /privacy. Verified hosted-account deletion requests are processed within 30 days except legal holds. Local data is deleted by removing local directories.","source":"docs/legal/PRIVACY_POLICY.md §6"},{"id":"incident","question":"What is the incident notification target?","answer":"For enterprise customers under a signed agreement that includes incident terms: notify the designated contact within 72 hours after confirming a personal-data or confidential hosted-content breach affecting that customer. Self-serve users without that schedule get commercially reasonable notice, not a contractual 72-hour SLA.","source":"docs/legal/SECURITY_AND_INCIDENT.md §5"},{"id":"vuln","question":"How do we report a vulnerability?","answer":"Email security@thumbgate.ai with “Security” in the subject. Do not file public GitHub issues for active vulnerabilities. Acknowledgement target: 48 hours.","source":"/security"},{"id":"inspect","question":"Can we inspect the control layer?","answer":"Yes. The public runtime is MIT-licensed at https://github.com/IgorGanapolsky/ThumbGate. Hosted operation, adapter coverage, and dashboard state are what a subscription buys — not a private intelligence split.","source":"MOAT.md and /legal/licensing"},{"id":"health","question":"How do we verify the live hosted build?","answer":"GET https://thumbgate-production.up.railway.app/health returns version and buildSha. Production claims require that buildSha to match the intended main commit.","source":"CLAUDE.md Deployment Verification Gate"}]}