— Trust Center
Trust Center.
Security, privacy, compliance — institutional details, written for procurement, security teams, and risk officers.
§ 01 · Certifications
What we attest to.
Planned · 2026 H2
SOC 2 Type II.
Audit scope defined across Security, Availability, Processing Integrity, Confidentiality, and Privacy. First report targeted for FY 2026.
In progress · 2026 H2
ISO 27001.
Information security management system. Stage 1 audit completed. Stage 2 audit and certification scheduled for the second half of 2026.
Aligned
GDPR.
EU General Data Protection Regulation. Standard Contractual Clauses (2021/914/EU) for transfers. Data Processing Agreement available. DPO assigned.
Compliant
PDPA Taiwan.
Personal Data Protection Act of Taiwan. Domestic compliance through our Taipei legal office. Registered with the National Development Council.
Operational
CTPAT supply chain.
Cross-border data and hardware supply chain aligned with CTPAT-equivalent customs-trade security guidance.
Annual
Penetration test.
Independent CREST-accredited firm. Annual external assessment plus quarterly internal scans. Summary available alongside SOC 2 under NDA.
§ 02 · Security practices
How the platform stays defended.
Encryption everywhere.
AES-256 at rest. TLS 1.3 in transit. Customer-managed keys where regulatory regime requires. Key separation between control plane and data plane. Annual cryptographic review by our security architect.
Network isolation.
Single-tenant deployments. No cross-customer data path. Private subnets, no public ingress to inference endpoints. Bastion access only, ephemeral credentials, full session logging.
Identity and access.
Mandatory multi-factor authentication. SSO via SAML 2.0 / OIDC for enterprise plans. Role-based access control with quarterly entitlement review. Privileged access logged and reviewed.
Vendor risk.
Every sub-processor onboarded under a written Data Processing Agreement aligned with GDPR Article 28. Annual vendor security review. Continuous monitoring for sanctions designation and breach disclosure.
Secure development.
Mandatory code review, automated SAST and DAST on every merge, dependency scanning, container image signing, and protected production deploy paths. Engineering teams complete annual secure-coding training.
§ 03 · Privacy framework
Data, on your terms.
DPO assigned
A named DPO.
DPO contact: horizon.lin722@taiwan-culture.com. Two-business-day acknowledgement. Thirty-day substantive response.
DPA on file
Data processing agreements.
Standard DPA aligned with GDPR Article 28 and PDPA-Taiwan. Available on request. Custom terms negotiable under MSAs.
SCC for transfers
Cross-border transfers.
Standard Contractual Clauses (2021/914/EU) for transfers outside the EEA. Transfer impact assessments documented in our Records of Processing Activities.
Full detail in the Privacy Policy.
§ 04 · Incident response
Four-hour acknowledgement window.
Our security operations centre operates twenty-four hours. Material security incidents are acknowledged within four hours of detection or notification. Notification to affected institutional clients happens within seventy-two hours of confirmed impact.
Incident acknowledgement
Initial containment plan
Client notification of confirmed impact
Post-incident review delivered
Confirmed security incidents are reportable to horizon.lin722@taiwan-culture.com. Encryption keys for sensitive disclosure available on request.
§ 05 · Sub-processors
Who else touches the stack.
We engage a short and intentionally minimal list of sub-processors. Each operates under a written DPA. Full register is shared under NDA. Material additions are notified in writing thirty days before they become active.
- Cloud infrastructure. Single-tenant compute and storage in Taiwan and the European Union. Region pinning per customer.
- Observability and monitoring. De-identified application telemetry. No customer payload data in monitoring stream.
- Payment and invoicing. Invoice generation, tax reporting, and reconciliation. Cardholder data is never processed by us — direct to PCI-DSS Level 1 acquirer.
- Identity provider. Enterprise SSO integration. Federation only. No password storage.
- External counsel and audit. Privileged communications and annual SOC 2 / ISO 27001 audits.
§ 06 · Responsible disclosure
Found something. Tell us.
We welcome good-faith security research on our public surface. Researchers who follow responsible disclosure are not pursued under unauthorised access statutes. Report at horizon.lin722@taiwan-culture.com with subject line "Security · Disclosure". We acknowledge within one business day.
Out of scope — social engineering of staff, physical attacks, denial-of-service tests, and findings on third-party properties not operated by mindsight-galaxy. A formal bug bounty programme launches in 2026 H2.
— Contact the security desk
One desk. Every question.
Security, privacy, compliance, and incident reports all reach the same team. Use horizon.lin722@taiwan-culture.com with a clear subject line — "Security", "Privacy", "Compliance", or "Incident". We acknowledge within one business day.
For procurement and sales, route through the institutional relations team.