Security Status

Website and intake status

• The owner-supplied Task 6A verification record states that `aiftrust.us` and `www.aiftrust.us` are active on Cloudflare Pages with HTTP 200. This is a supplied operational report and was not independently re-probed from the environment used for this review.
• The early-access endpoint is a preview implementation. Its current handler uses ephemeral in-memory state, has no durable D1/KV-backed application store, and does not send staff notifications or CRM records. An HTTP 200 is not proof that a lead was durably saved or will be reviewed.
• Do not submit secrets, confidential production information, or time-sensitive application data through the preview intake. Do not infer production security controls from the existence of this website.

Known UFA limitations

• SandboxRunner subprocess constraints are not a container or virtual-machine security boundary.
• Chromium uses `--no-sandbox` by default unless `UFA_BROWSER_SANDBOX=1` is configured.
• API authentication is opt-in, and the operator console binds to loopback without authentication. Do not expose it publicly without a reviewed authentication boundary.
• Credential FileVault is chmod-0600 JSON rather than a KMS/HSM-backed vault; MCP/plugins execute in-process and may pose host-level risk.
• Routing quality scores still include human priors, verification remains model-driven for ordinary goals, and the documented configuration has no API rate limiting.

The accepted evidence baseline is Wave 19: 312 passed / 0 failed / 1 warning and 12/12 acceptance missions at the stamped code SHA dated October 8, 2026. This is historical test evidence, not a fresh test of the current main HEAD or proof of containment.

Controls and verification

Control descriptions should be treated as verified only when they have current configuration/code evidence, repeatable tests, and a documented scope. We do not claim platform-wide enforcement, KMS/HSM storage, customer-managed keys, universal TLS configuration, temporal namespace isolation, or independent replay from the demonstration JSON files on this site.

OpenMuse observer work remains on draft, disconnected, unaccepted UFA pull requests. It is not a production integration. Wave 29 confinement/startup work is also unaccepted and has not upgraded UFA's security status.

Certification status

No SOC 2, ISO 27001, or FedRAMP certification is currently claimed. Any future attestation status will be published only when supported by a valid third-party report. The security status of a future customer deployment must be assessed against its specific configuration and signed scope.

Responsible disclosure

To report a vulnerability, use [email protected]. Include a concise description, impact, reproduction steps, affected component/version, and a follow-up contact. Do not include credentials, unrelated personal data, or customer data.

No response-time or remediation SLA is represented on this page. Obtain permission before conducting intrusive testing, automated scans, denial-of-service testing, or any testing against third-party or customer environments.