LINK’s security is a written set of controls. Each one is mapped to the SOC 2 Trust Services Criteria and NIST CSF 2.0, tested in code where it can be, and marked honestly when it is still in progress.
Self-assessed against NIST CSF 2.0 · October 2026 · No certifications claimed
Every control is in one of three states, and we publish how many are in each. Each lot below is one NIST CSF 2.0 function; each parcel in it is one control.
Each parcel is one control, placed under its primary NIST CSF 2.0 function; many controls serve several. Counts as of 2026-10-05. The control-by-control detail is in our security package.
| NIST CSF 2.0 function | In place | Partly in place | Planned | Not applicable | Total |
|---|---|---|---|---|---|
| Govern | 3 | 5 | 9 | 1 | 18 |
| Identify | 5 | 2 | 2 | 0 | 9 |
| Protect | 17 | 19 | 3 | 0 | 39 |
| Detect | 2 | 3 | 0 | 0 | 5 |
| Respond | 0 | 4 | 1 | 0 | 5 |
| Recover | 0 | 3 | 0 | 0 | 3 |
| All controls | 27 | 36 | 15 | 1 | 79 |
Only what is true today, with what comes next where the work is not finished.
All traffic to LINK travels over TLS. Data at rest is encrypted by our managed database and storage provider.
In placeEvery record belongs to a company and a division. A database gate refuses anyone who is not a member, and row-level security scopes each table to the people who should see it.
Next: an independent test suite that proves isolation between customers.Partly in placeStaff powers are named and granted one at a time. Acting as one of your users needs an explicit impersonation power for your company, and every staff request through the app is logged to the person who made it.
Next: retiring the legacy all-access admin role in favour of named powers everywhere, and attributing staff access made outside the app.Partly in placeChanges reach production only through a pull request that passes our full automated suite, about 8,500 tests including access-control tests. High-stakes changes get an independent review before any code is written.
In placeErrors alert us as they happen. Every production incident gets a written post-mortem that ends in a new rule, so we fix the cause and not just the symptom.
In placeOur database provider keeps daily managed backups of LINK data. On 5 October 2026 we restored a backup into a separate, isolated project and checked it against production. The restore took about six minutes. We repeat this drill every quarter.
Next: point-in-time recovery, switched on before our first outside paying customer.Partly in placeEach customer company is its own parcel. Its divisions and people sit inside it, and there is one way in.
Every request to the LINK database passes a gate that checks the caller belongs to an active division, then row-level security limits it to that division’s data. Daedalus staff are logged separately: every staff request through the app is recorded to the person who made it, and acting as one of your users needs an impersonation power granted for your company.
Independent validation comes last on purpose: an auditor should find a program that already runs, not one assembled for the audit.
Every control written down and mapped to SOC 2 and NIST CSF 2.0. The system’s scope documented. A check in our build fails if any area is left without a control.
Each control verified against our code and production. The result becomes a public NIST CSF 2.0 profile with current scores, not targets.
Written security policies, and a vendor inventory with reviews of our providers’ own audit reports. Our incident response and disaster recovery plans are already written.
A CSA STAR Level 1 self-assessment on the public registry. A SOC 2 Type I audit when a customer requires one.
No. SOC 2 is an audit report issued by an independent CPA firm, not a certification, and we do not have one yet. We have mapped our controls to the SOC 2 Trust Services Criteria for Security, Availability and Confidentiality, so an audit can start when a customer needs one.
LINK is built and run by one engineer today. That is why our controls lean on automation: every change must pass the full automated test suite, high-stakes changes are reviewed by an independent AI model before any code is written, and changes to the production database are a separate, deliberate step. We would rather tell you than have you find out.
In the United States. The application runs on Vercel, and the database, sign-in and file storage run on Supabase, both in the US East region. Your data lives only there. We also operate one administrative server, used for development and for scheduled jobs that load market data into LINK. It does not serve the application or store customer data, and it is covered by our security controls.
A formal subprocessor list, published with our data processing addendum, is on our path.
Email security@xdaedalus.com with “Security” in the subject. Every report is read, and we will work with you on a fix and on timing before anything is disclosed.
Yes. Our security package includes the full control matrix and our system description. Ask for it here; we share it under NDA.
Send us your questionnaire, or ask for our security package. You will get an answer from the person who built the controls.