Security Policy

Maximus is built for security-sensitive work. We combine defense-in-depth controls, tenant isolation, encryption, monitoring, and secure development practices. We review this policy regularly and update it when our practices or threat landscape change.

Platform (Adversys) • Host and patch application infrastructure • Enforce tenant isolation and access controls at the platform layer • Encrypt sensitive data in transit and at rest • Monitor for abuse and respond to incidents affecting the platform Customer organization • Manage users, roles, and offboarding • Maintain written authorization for security tests and scans • Protect account credentials and LLM API keys • Configure integrations securely and review vendor terms • Classify and handle findings and reports according to internal policy

• Cloud-hosted infrastructure with providers that maintain industry-standard certifications and audits • Network segmentation and firewalls to limit exposure • TLS for data in transit; AES-256 (or equivalent) for sensitive data at rest • Timely application of security patches and dependency updates • Continuous monitoring, logging, and alerting for anomalous activity

• Authentication via industry-standard mechanisms (including SSO where configured) • Role-based access control (PM, SME, Admin, Platform Admin) within each tenant • Multi-factor authentication for privileged Adversys administrative access • Principle of least privilege and periodic access reviews • Audit logging of administrative and security-relevant actions

Each organization operates in a logically isolated tenant. Users, engagements, projects, credentials, LLM profiles, and integration settings are scoped to the active organization. We design and test controls intended to prevent cross-tenant data access.

• Secure development lifecycle practices, code review, and dependency management • Vulnerability scanning and penetration testing of the Maximus application • Separation between customer assessment workloads and platform control plane where architecturally appropriate • Responsible disclosure: report suspected vulnerabilities to MarkC@adversys.ai

• Encrypted backups and tested disaster recovery procedures • Data retention aligned with Customer agreements and administrator actions • Secure deletion procedures when tenants or data are decommissioned • Customer content is not used to train public third-party models via Adversys's AI features; LLM processing occurs through providers Customer selects

We maintain an incident response program that includes detection, containment, investigation, remediation, and post-incident review. If we confirm a security incident that materially affects Customer personal data or tenant confidentiality, we will notify affected Customers without undue delay and provide information reasonably available to help them meet their obligations. Report security concerns to MarkC@adversys.ai.

We design controls with reference to widely recognized frameworks and applicable regulations, which may include privacy laws such as the CCPA/CPRA for California residents. Specific compliance commitments (for example, SOC 2 reports or DPAs) are provided in Customer agreements when applicable—not all commitments apply to every deployment model.

To maintain a secure environment, Customer and its users should: • Use strong, unique passwords and enable MFA where offered • Limit Admin and Platform Admin roles to trusted personnel • Rotate integration and LLM credentials when personnel change • Report suspected compromise or policy violations promptly • Never share device enrollment tokens or API keys in unsecured channels

We post updates at /docs/legal/security with a revised "Last updated" date. Material changes may be communicated through in-product notice or email where appropriate. Adversys Inc. Security contact: MarkC@adversys.ai Address: 6977 Navajo Rd, San Diego, CA 92119-1503, United States These policies describe our standard practices and are published for transparency. If your organization has a signed agreement with us (for example, an MSA, order form, or data processing addendum), that contract controls where it conflicts with this summary. Please share these documents with your legal counsel before relying on them for compliance decisions.