Trust · Policy library
The 18 policies we operate under.
Every policy is in our public repo. Reviewed annually, versioned in git, signed by the team. Customer-facing copies are downloadable below; internal-only policies are listed but their bodies are private.
See also: Vulnerability disclosure · Full repo
Core
Data handling
Four-level classification (Restricted / Confidential / Internal / Public) with per-level handling requirements.
Retention windows by data class, DSR-driven deletion (30-day SLA), disposal methods.
Approved algorithms, key management, rotation cadence, TLS minimums.
Engineering
Threat-modeling discipline, code-review expectations, dependency hygiene, deployment standards.
Operational
Who can access production, with what role, and how we prove the access was reviewed quarterly. Drives the production-access-inventory feature.
How code reaches production — PR → CI → AI-assisted review → branch-protected merge → auto-deploy.
Severity definitions, response phases, communication SLAs, tabletop cadence.
RTO / RPO targets, backup posture, quarterly DR test procedure, key-person succession plan.
Dependabot + annual pen test + severity-based remediation SLAs. Aligned with SECURITY.md.
How sub-processors are selected, onboarded, monitored, and offboarded. 30-day customer notice for adds.
What we log, what we never log, retention, alerting cadence.
Backup mechanism per asset class, retention windows, quarterly restoration test.
People
What employees + contractors can and can't do with Resolute systems.
Minimum behavioral standard for everyone with Resolute credentials.
Per-system checklists for joiners + leavers. Even at headcount of 1.
Required factors, ordering, lockout thresholds, the no-SMS rule.
Memos & supporting documents
Not policies — context the auditor will ask about, especially around solo-founder operations.
Solo-founder succession + business-continuity plan. Sealed envelope, attorney POA, customer-facing communication templates.
Eight compensating controls that substitute for human-to-human SoD while we're a one-engineer team.
Ten specific failure modes (founder lost device, MFA factor lost, sub-processor BK, etc.) with documented mitigations.
18-entry quantitative risk assessment, scored Likelihood × Impact, tiered + reviewed quarterly.
For your security team
Need a specific policy under NDA, or a SOC 2 readiness attestation pack? Email security@resolute-security.com. The Security Review Packet PDF bundles the most-requested customer-facing artifacts in one download.