SECURITY
POLICY

1. Overview

SAPIEN X builds a sovereign reasoning layer for ISR, deployed onboard unmanned platforms and in command centres. Our customers and partners operate in defence and security environments. Security is a design principle of the product and of the way we run the company.

This policy describes the measures that protect our website, the information exchanged with us, and the software we deliver.

2. Product security by design

The SAPIEN X reasoning layer is built for contested and disconnected environments:

• Runs fully offline, on the platform and on the customer's own infrastructure, with no cloud dependency
• Deployable air-gapped, with zero egress
• Software updates are cryptographically signed
• Operational data and imagery remain on customer infrastructure and are not transmitted to SAPIEN X

3. Website security

• All traffic encrypted in transit (HTTPS / TLS); unencrypted requests are redirected
• HTTP Strict Transport Security and a restrictive Content Security Policy
• Protection against framing, content-type sniffing and cross-origin abuse
• Network-level protections provided by our hosting infrastructure
• No public exposure of internal systems

4. Briefing requests

Briefing requests are protected by layered anti-abuse controls (hidden honeypot field and reCAPTCHA) and validated before processing. No submitted data is stored in the visitor's browser. Access to submissions is restricted to authorised SAPIEN X personnel.

5. Information exchanged with partners

• Technical briefings, demonstration material and integration documentation are shared under NDA
• Documents are marked according to our Classification Policy
• Sensitive material is exchanged through encrypted channels only
• Access within SAPIEN X follows a need-to-know principle

6. Incident response

• Immediate containment and investigation on detection of an incident
• Notification of affected parties within 72 hours of confirming a breach involving personal data, in line with applicable regulations
• Incident report to affected parties covering nature, scope and remediation
• Cooperation with the competent authorities as required by law

7. Vulnerability disclosure

We welcome responsible disclosure of security vulnerabilities. We do not run a public bug bounty programme. Reports are acknowledged within 5 business days and confirmed vulnerabilities are addressed promptly.

8. Policy updates

This policy is reviewed as our product, infrastructure and threat landscape evolve. The "Last updated" date reflects the latest revision.