Skip to content
← Legal

Security

The security controls Demiurge Systems actually implements — and an honest statement on certification status (including SOC 2).

Version 1.0 Effective 25 July 2026 Last updated 25 July 2026

You are viewing the static copy of this page (scripts have not loaded). All content below is complete and current.

We describe only controls that are actually implemented or evidenced in our infrastructure and codebase, and we are explicit about what is not yet in place.

Certification status — read this first

Demiurge Systems is NOT SOC 2 certified, SOC 2 attested, or independently audited at this time. We do not hold a SOC 2 Type I or Type II report, and we make no claim of SOC 2 compliance. We do not display certification badges, audit dates, penetration-test claims, or compliance percentages, because none have been independently verified.

The controls below are those genuinely implemented today. Where a capability is provided by a specialist subprocessor (e.g. payments, database), we say so rather than claim it as our own audited control.

Implemented controls

  • Encryption in transit — the entire site and all API endpoints are served over HTTPS/TLS with HTTP Strict Transport Security (HSTS) enabled.
  • Security headers — responses set HSTS, X-Content-Type-Options: nosniff, X-Frame-Options, and a strict Referrer-Policy.
  • Payment data isolation — card details are captured and processed entirely by our PCI-DSS-compliant payment processor via its hosted checkout; our systems never receive or store card numbers.
  • Secret management — API keys and credentials live only in managed server-side environment configuration, never in client-side code, and are redacted from diagnostic responses.
  • Input validation & sanitisation — all form submissions are validated and sanitised server-side before any downstream use.
  • Spam & abuse controls — honeypot fields plus server-side rate limiting on intake endpoints.
  • Audit logging — signup events are recorded to an append-style audit log for traceability (where our database provider is configured; order events are recorded by our payment processor).
  • Least-data by design — we avoid placing personal or sensitive data in URLs/query strings.

Controls provided by our infrastructure providers

The following are delivered and maintained by specialist providers under their own security programmes (several of which hold their own independent certifications):

  • Encryption at rest, backups, and database access controls — provided by our managed database/auth provider.
  • Payment security and PCI-DSS scope reduction — provided by our payment processor.
  • Platform, network, and edge security, and DDoS mitigation — provided by our hosting/CDN provider.

Their certifications are theirs, not ours; we reference them only to describe where a control lives.

In progress / not yet implemented

We are transparent about gaps. The following are not yet formally established as independent, documented controls:

  • A completed SOC 2 (or ISO 27001) audit and report.
  • A formal, documented incident-response and business-continuity programme.
  • Scheduled independent penetration testing.
  • Automated dependency/vulnerability scanning in CI and a formal secure-SDLC policy.
  • Formal, org-wide access-review and monitoring procedures.

Reporting a security issue

If you believe you have found a vulnerability, contact ops@demiurge.systems with details and we will respond promptly. Please act in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before any disclosure.

Requesting security information

For a security questionnaire, a summary of controls, or documents available under NDA, use /contact and select “Security enquiry”. We will distinguish clearly between implemented controls, controls in progress, and any third-party attestations that exist.

Demiurge Systems Ltd · Registered in England · 17109558 · Document version 1.0.