Trust Center

Security and Trust

An honest account of our current security posture, what we store, how provenance integrity works, and what rights you hold over your data. No certifications are claimed that we do not hold.

Legal identity

Abraham of London is operated by Alomarada Ltd, a UK registered company. Company no. 11549053.

Verify on Companies House

Security assurance status

Current

  • Provider posture disclosed
  • Cloudflare DNS boundary stated
  • Sub-processors named
  • Data handling stated
  • Provenance boundary stated

Not yet completed

  • SOC 2
  • ISO 27001
  • Independent penetration test

Security assurance readiness

Independent SOC 2, ISO 27001 certification, and external penetration testing are not yet complete. The current assurance posture is documented through legal identity, infrastructure disclosure, sub-processor visibility, pilot data boundaries, incident-response posture, and provenance / auditability controls.

Operational Governance

Abraham of London operates administrative, publishing, and support workflows through a governed command environment. Access to sensitive operations is role-gated: different authority levels unlock different capabilities, and the most consequential controls — including platform-level lock and unlock — require the highest authority tier.

Report lineage is recorded end-to-end. Every material event — creation, viewing, export, update, escalation, revocation — is written to an append-only ledger. Reports can be revoked by authorised operators; revocation is logged with actor, timestamp, and authority. Cohort privacy is enforced at both write time and read time: any subgroup that falls below the minimum respondent threshold is suppressed before it reaches any output surface.

External platform integrations, including LinkedIn, are treated as controlled publishing channels. Permissions are scoped to the operational purpose, credentials are kept server-side, and publishing activity is limited to authorised operators. Internal coordination channels support incident response, deployment review, and operator accountability. They do not replace governance; they support it.

What this means in practice

Governed decision infrastructure

A structured way to record, test, and follow through on important decisions.

Evidence posture

Whether the decision is supported by facts or mainly by assertion.

Consequence path

What happens if the decision is delayed, wrong, or not acted on.

Institutional memory

A durable record of what was decided, why, and what changed later.

Provenance

The accountable chain showing what was reviewed, constrained, delivered, and recorded.

Security posture

DNS / registrar

Namecheap remains the registrar. Cloudflare is authoritative DNS for abrahamoflondon.org. Netlify remains the production application hosting/CDN origin.

Hosting

Netlify remains the production application host/origin, including CDN and serverless functions. TLS 1.2+ is enforced for the hosted application.

TLS boundary

Cloudflare edge certificates may be available for proxied hostnames, while Netlify continues to manage origin/application TLS for the hosted site. Certificate validation and renewal depend on the active DNS/proxy posture.

Cloudflare boundary

Cloudflare is used as the authoritative DNS provider for abrahamoflondon.org. Edge security features such as proxying, WAF/rate-limiting, bot controls, DLP, and Zero Trust are configured only where explicitly enabled and verified.

Authentication

Managed via NextAuth.js. Session tokens are short-lived. Magic link and OAuth supported.

MFA / SSO

Enterprise SSO and enforced organisation-level MFA are not yet represented as generally available. Availability can be reviewed for qualified enterprise deployments.

Administrative access

Administrative access is limited to authorised operator/admin roles for support, review, delivery, and security operations. Certain provenance and admin operations are logged for review.

Database

PostgreSQL via Prisma ORM. Parameterised queries throughout. No raw SQL strings in user-facing paths.

Secrets management

Environment variables via Netlify. No secrets in source control. No plaintext keys in logs.

Dependency scanning

pnpm audit on every install. Dependabot alerts enabled.

Rate limiting

Applied to all public API endpoints. IP-level limits enforced server-side.

Error handling

Internal errors are logged server-side. Stack traces are never returned to clients.

Data handling

What we store

Governed case records, assessment results, session data, and authentication credentials. No financial data is processed or stored directly.

What we do not store

Raw payment card data. Your evidence content is stored as you submit it — we do not process it for any purpose beyond the product features you use.

Data location

Default infrastructure may involve UK/EU/US provider regions depending on the service used. Region-specific deployment, data residency commitments, and transfer terms must be agreed during enterprise procurement or contract review; no blanket residency guarantee is represented for all accounts.

Retention

Active cases are retained while your account is active. Deleted cases are soft-deleted and permanently purged after 30 days.

Third-party access

Sub-processors listed below. No sale of personal data. No data sharing for advertising. DPA and sub-processor review can be handled through the security assurance request process.

Analytics and telemetry

Product analytics may be used to understand usage, reliability, and product improvement. Specific telemetry fields and account-level restrictions can be reviewed through the security assurance process.

Encryption at rest

Database encryption managed by hosting provider. Application-level field encryption applied to sensitive governance fields.

Backups

Daily automated backups are retained for 7 days. This is not a contractual RTO/RPO commitment; restore-testing posture and available evidence can be discussed through the security assurance process.

Provenance boundary

The provenance system computes and stores SHA-256 hashes of canonical case records. This creates structural tamper-evidence — if a record changes after sealing, its hash no longer matches. Verification is performed on demand; results are not cached.

Terms used here

Sealing
Finalising a record and computing its hash, closing it against undetected modification.
Tamper-evidence
If any field changes after sealing, the hash no longer matches — changes become detectable.
Hash
A unique fingerprint of a record's content. Any change produces a different fingerprint.
Anchoring
Publishing the hash to an external immutable log so verification does not depend solely on internal records.

Internal chain anchoring

Live

Hash computed and stored for supported governed records at time of sealing.

External WORM anchoring

Architected, not live

Architecture designed. Not yet connected to an external immutable log. No blockchain or public ledger claims are made.

Client-facing hash verification

Live

Authenticated users can verify supported records via /api/provenance/verify-case.

Public demo verification

Live

Anyone can verify the canonical demo record at /provenance/demo.

Certifications and compliance

We state exactly what we hold and what we do not. No certifications are implied beyond what is listed here.

Company / platform certifications

SOC 2 Type I

Planned

Not yet held. Planned as part of enterprise readiness programme.

SOC 2 Type II

Not yet

Not yet held. Follows SOC 2 Type I. No timeline committed publicly.

ISO/IEC 27001 organisational certification

Not yet

Not yet held.

Independent security audit

Planned

Planned before enterprise GA. Specific firm not yet engaged.

GDPR compliance programme

In progress

Data rights fulfilment (deletion, export) implemented. DPA available on request for enterprise accounts.

CCPA compliance

In progress

Data rights implemented. Privacy policy covers CCPA requirements.

Founder assurance credentials

Abraham Adaramola holds an ISO/IEC 27001:2022 Lead Auditor credential and has formal training across consulting management, company direction, cybersecurity, business development, and MBA-level brand leadership.

These credentials support assurance literacy, audit awareness, and governance discipline. They should not be read as independent certification of Alomarada Ltd, Abraham of London, or the platform.

View founder profile on LinkedIn

ISO/IEC 27001:2022 Lead Auditor

Live

Abraham Adaramola — Mastermind Assurance

Level 7 Diploma in Consulting Management

Live

Chartered Management Institute, 2017

MBA, Brand Leadership

Live

University of East Anglia, 2017

Cybersecurity training

Live

Formal cybersecurity training supporting assurance literacy.

Sub-processors

Cloudflare

Authoritative DNS, DNS security, edge TLS/proxy/security services where explicitly enabled

Global network

Netlify

Hosting, CDN, serverless functions

US/EU

Neon / PostgreSQL

Primary database

EU

Upstash Redis

Rate limiting, session caching

EU

Resend

Transactional email (magic links, notifications)

US

Stripe

Payment processing (where applicable)

US/EU

Vercel Analytics / PostHog

Anonymised product analytics

EU

Uptime and status

Status page

A public status page is not yet published. Internal/system health checks exist, but they should not be read as a public status history or uptime SLA.

Incident notification

Material incidents are notified via email to affected accounts. For current pilots, incident communication expectations should be agreed within the engagement scope.

Target uptime

99.5% monthly operating target. This is not represented as a guaranteed uptime SLA unless separately agreed in contract.

Planned maintenance

Notified by email where downtime exceeds 5 minutes.

Responsible disclosure

If you discover a security vulnerability, please report it privately. We commit to acknowledging receipt within 2 business days and communicating a remediation plan within 10 business days.

Report to

support@abrahamoflondon.org with subject "Responsible Disclosure Report"

Scope

Authentication, provenance integrity, data exposure, privilege escalation.

Out of scope

Rate limiting bypasses for non-sensitive endpoints, UI cosmetic issues, SPF/DKIM configuration.

Bug bounty

No formal bounty programme at this stage. Responsible researchers are credited where they consent.

Your rights

Only rights that are implemented are listed here.

Right to deletion

Live

You may delete any governed case you own from Decision Centre. Deletion is permanent after a 30-day grace period. API: DELETE /api/cases/[caseId].

Right to export

Live

You may export all your personal data in JSON format from Decision Centre or account settings. Export excludes raw internal governance fields. API: GET /api/user/data-export.

Right to rectification

Live

You can correct case metadata (case name, status) through Decision Centre. Assessment results themselves are immutable — their integrity depends on immutability.

Right to restriction

Live

The system does not use personal data for automated decision-making beyond the explicit governance features you opt into. No profiling for advertising or third-party scoring.

Right to portability

In progress

Covered by the data export function. Machine-readable JSON. Structured export format under review.

To exercise any right or to request a Data Processing Agreement, contact support@abrahamoflondon.org.

Example

Decision submitted

“Should we delay a regional launch because operations cannot support the promised service level?”

System tests

  • Evidence gap — is the service-level shortfall documented or asserted?

  • Authority ambiguity — who owns the go or no-go, and have they been named?

  • Cost of delay — what accrues each week the launch does not happen?

  • Escalation condition — what event forces the decision, with or without action?

Governed output

Required move

Quantify the service-level gap before the launch date is revisited.

Named owner

Operations lead — accountable for the evidence report.

Checkpoint

Review in 5 days. If evidence is not ready, delay is the governed finding.

Consequence if ignored

Launch proceeds on assertion, not evidence. Governance gap is recorded.

Memory carried forward

The condition, the required move, and the checkpoint are written to the decision record.

Contact for security review

Enterprise and procurement enquiries requiring a security review pack, DPA, or detailed architecture briefing should use the link below.

Related

Abraham of London provides governed decision instruments and structured advisory frameworks. Nothing on this page constitutes legal, financial, investment, tax, medical, immigration, accounting, or other regulated professional advice. Access fees, where applicable, are charged for methodology access, software-enabled records, structured outputs, and session facilitation, not for guaranteed outcomes.