This page indexes CloakAPI's compliance, legal, and security documentation. Each row shows the artefact, its status, a link, and when its source document was last updated.
If you need a curated PDF packet for internal procurement review, a custom vendor questionnaire response, or an evidence package for a specific control, contact trust@cloakapi.io. We respond to enterprise procurement requests within 2 business days.
The documents and controls that exist today. We publish what's real and won't display an attestation we don't hold.
| Artefact | Status | Updated | Action |
|---|---|---|---|
| PCI DSS v4.0 Payment card industry data security standard |
Out of scope (SAQ-A) | 2026-07-10 | Details |
| CAIQ-lite (CCM v4) Cloud Security Alliance self-assessment, 50 controls |
Published | Open |
Contracts, templates, and data agreements available now.
| Artefact | Status | Updated | Action |
|---|---|---|---|
| Terms of Service Master service agreement covering gateway, portal, and desktop client |
Published | Open | |
| Privacy Policy Data collection, GDPR basis, retention windows, your rights |
Published | Open | |
| Data Processing Addendum (DPA) GDPR Article 28 — pre-signed template, request counter-signed copy |
Published | Open | |
| Sub-processor List All sub-processors, region, purpose, 30-day change notifications |
Published | Open |
Uptime, performance, support response targets, credits, and disaster recovery.
| Artefact | Status | Updated | Action |
|---|---|---|---|
| Service Level Agreement (SLA) availability and latency defined and measured, credits, support response targets — no target committed during beta |
Published | Open | |
| Business Continuity & DR Plan Architecture, backups, RTO 4h / RPO 6h, annual DR drill |
Published | Open | |
| Live Status Page Real-time service health, incident history, postmortems |
Live | Real-time | Open ↗ |
Security policy, vulnerability disclosure, and independent verification tools.
| Artefact | Status | Updated | Action |
|---|---|---|---|
| Security Policy Acceptable use, incident response, key management, access control |
Published | Open | |
| Vulnerability Disclosure Policy Coordinated disclosure, safe harbour, scope, hall of fame |
Published | Open ↗ | |
| Receipt Verifier Verify any CloakAPI cryptographic receipt offline — no account needed |
Live | Real-time | Open ↗ |
| Transparency Log Current published tenant seed state; the separate Merkle API exposes proofs for recorded events |
Live | Real-time | Details |