For security disclosures or potential vulnerability submissions, please email our security response team directly at [email protected]. For general security inquiries, contact us at [email protected].
1. Certifications & Compliance Roadmap
We are actively formalizing our enterprise trust and security assurances:
SOC 2 Type II & Third-Party Penetration Testing
In Progress / Coming SoonOur team is currently preparing for formal third-party SOC 2 Type II audits and independent penetration tests. Formal attestation reports will be made available on request once fully certified. We will notify all registered users and updates will be posted here as soon as certification milestones are completed.
- Continuous Vulnerability Auditing: Internal automated dependency scanning and code analysis tools run continuously across all production repositories.
- Annual Audits: Once initial audits conclude, AnotiAI will commit to annual third-party penetration assessments by accredited cybersecurity firms.
2. Infrastructure & Hosting Security
WhoseDev services are hosted across modern, resilient cloud infrastructure enforcing strict security controls:
- Authentication & Caching Layers: Identity management is protected using Firebase Authentication, while high performance session tokens are managed in memory via encrypted Redis instances.
- Payment Security Isolation: All billing processes are delegated directly to Stripe. WhoseDev infrastructure never receives, processes, or stores raw credit card details or financial credentials.
- Least Privilege & Access Control: System administration access follows strict least-privilege principles. Multi-factor authentication (MFA) is enforced across all engineering and management accounts.
- Encrypted Storage & Transit: Network data is protected using TLS 1.3 in transit. Stored system data and session tokens are encrypted at rest using AES-256 standards.
3. Client, IDE & Local Isolation Security
WhoseDev offers flexible security modes depending on how you choose to run AI completions:
Local On-Device Execution (Ollama)
- Runs 100% locally on your workstation over internal loopback ports.
- Zero network egress: prompts, code files, and context never leave your hardware.
- Ideal for strict air-gapped or high-security corporate environments.
Cloud Model Redaction Filters
- Client-side regex engines detect and redact hardcoded secrets, API tokens, and private keys before remote transmission.
- Transmitted code context is streamed transiently in memory and purged immediately after completion generation.
4. Securing Our Own Codebase
We practice defensive engineering by using WhoseDev and local AI tools internally to inspect, test, and harden our own applications:
- Automated Code Reviews: Pre-commit hooks run secret detection and static security analysis on every pull request.
- Dependency Patching: Upstream security advisories and framework patches are reviewed and deployed immediately upon release.
5. Privacy Mode & Zero Model Training
Your source code is your intellectual property. We maintain strict privacy guarantees across all tiers:
- Zero Code Model Training: WhoseDev does not train base AI models on your private source code, prompts, or context files.
- Contractual Provider Protections: Our integrations with cloud model providers (OpenAI, Anthropic, Gemini, DeepSeek) enforce enterprise data protection agreements prohibiting model training on prompt streams.
6. Account Deletion & Data Purge
You retain total control over your data lifecycle:
- Self-Service Account Termination: You can delete your account at any time within WhoseDev settings or by contacting [email protected].
- 90-Day Cold Backup Purge: Account credentials and synced workspace settings are deactivated immediately from active databases and permanently cleared from encrypted cold storage backups within 90 days.
7. Vulnerability Disclosures & Reporting
If you believe you have discovered a security vulnerability in WhoseDev, please submit a detailed disclosure report to our security team:
Direct Security Email: [email protected]
Response Commitment: We acknowledge security bug reports within 5 business days and prioritize critical vulnerability fixes.
Incident Notifications: If a critical security incident affecting user accounts occurs, impacted users will be notified via email alongside remediation guidance.