Security Statement

1. Overview

EverRise Systems Inc. builds ACE Platform, a secure BYOC automation platform for governed workflows. ACE is designed to help regulated and operations-heavy teams manage requests, tasks, approvals, workflow status, audit history, evidence references, role-based access, tenant separation, operational records, reporting, and related workflow controls.

Our security approach is based on control, auditability, evidence, identity governance, customer-controlled infrastructure, and human review. ACE is intended to help teams move faster without giving up accountability, traceability, or security oversight.

2. Current Security Status

ACE has completed a secure foundation milestone identified internally as v0.4.10-secure-foundation-final-candidate. This milestone reflects foundational work across repository structure, platform controls, security documentation, and deployment guidance.

3. BYOC Security Model

ACE currently supports Bring Your Own Cloud deployment. Under the BYOC model, ACE is deployed inside the customer’s cloud or approved infrastructure so the customer can retain control over data, identity provider, users, roles, database, secrets, logs, monitoring, backups, retention, network policies, security configuration, and production approval.

Potential deployment targets may include Azure, Azure Government, AWS, AWS GovCloud, private Kubernetes, on-premises Kubernetes, or approved enterprise container platforms. Each deployment target must be validated for the specific customer environment.

ACE is not currently presented as an EverRise-hosted SaaS product, self-service public cloud product, hosted GovCloud SaaS, or FedRAMP-authorized SaaS.

4. Shared Responsibility

Security in a BYOC deployment is a shared responsibility between EverRise and the customer. The customer controls the infrastructure environment. EverRise provides ACE Platform, productized implementation, configuration support, deployment guidance, and platform-related support according to the applicable agreement.

5. Identity and Access

ACE Core provides the security and governance foundation for identity, roles, tenant separation, audit logging, and deployment controls. Current foundation areas include authentication, SSO/OIDC, sessions, users, roles, permissions, and administrative controls.

• Customer-controlled identity provider configuration is supported through the BYOC model.
• Role-based access control is designed to support separation of duties and permission boundaries.
• Administrative access should be limited to authorized personnel with a defined operational need.
• Customer administrators remain responsible for user lifecycle management and role assignments in their environment.

6. Tenant Separation

ACE is designed with a tenant-aware access model. Tenant separation is part of the ACE secure foundation and is intended to help keep users, roles, permissions, workflow records, audit records, and operational data scoped to the appropriate customer or tenant boundary.

Tenant configuration and validation must be reviewed for each customer deployment. The effectiveness of tenant separation depends on correct implementation, configuration, environment controls, and access policies.

7. Audit and Evidence

ACE is designed to help teams prove what happened by preserving workflow history, approval history, audit events, and evidence references. These capabilities are intended to support internal accountability and operational visibility.

• Audit logging foundation is part of the ACE secure foundation milestone.
• Evidence references may support customer-managed compliance and review processes.
• ACE may help organize audit and evidence workflows, but it does not replace required audits, assessments, certifications, or customer security responsibilities.
• Retention policies, log destinations, SIEM integrations, and evidence handling must be validated for each deployment.

8. Deployment Controls

EverRise uses an operator-led deployment model to help selected customers configure their first governed workflows, validate audit and evidence needs, and prepare for controlled use inside the customer’s own environment.

Deployment planning may include environment readiness review, SSO/OIDC setup support, RBAC setup, tenant setup, audit configuration, evidence workflow setup, first workflow configuration, dashboard/reporting configuration, admin training, production readiness review, and expansion planning.

Deployment activities are productized, scoped, and repeatable. They should not be interpreted as unlimited consulting or as a transfer of EverRise source code, proprietary software ownership, or platform architecture rights.

9. Monitoring and SIEM Readiness

ACE’s secure foundation includes monitoring and SIEM readiness guidance. In BYOC deployments, monitoring, alerting, SIEM ingestion, log retention, and operational response are typically configured within the customer-controlled environment.

Customer security teams should validate what logs are collected, where logs are stored, how long logs are retained, who can access logs, what alerts are required, and how incidents are escalated within the customer’s own operational model.

10. Backup and Restore

ACE’s secure foundation includes backup and restore guidance. In a BYOC deployment, the customer generally controls the database, storage, backup systems, retention settings, and disaster recovery configuration.

Before production use, customers should validate backup frequency, restore procedures, access to backups, retention requirements, encryption settings, recovery objectives, and operational ownership for backup and restore activities.

11. Supply Chain and Releases

ACE’s secure foundation includes supply-chain release assurance guidance. EverRise works to maintain controlled release practices for the ACE software layer, including documentation and review practices appropriate for the current stage of the platform.

Customers may request additional release documentation, security questionnaires, architecture review materials, or procurement security materials as part of a qualified assessment or written customer engagement.

12. Automation and AI Governance

ACE is expanding toward governed automation capabilities, including workflow runs, tasks, approvals, evidence records, templates, connectors, reporting, and optional AI Assist. Roadmap capabilities may change and are not guaranteed unless expressly included in a signed written agreement.

AI Assist, where offered, is intended to be optional, governed, tenant-scoped, logged, permission-controlled, and subject to customer approval. ACE is designed so AI can help draft, summarize, and review information while humans, approvals, and audit controls remain in charge.

• AI must be optional and customer-approved.
• AI-off mode should be supported where applicable.
• Sensitive AI output should require human review.
• AI actions should be logged and tenant-scoped.
• AI should not make final sensitive decisions.

13. Compliance Position

ACE is designed around security and governance principles, including role-based access, tenant separation, audit logging, evidence tracking, BYOC deployment, and customer-controlled identity.

ACE is not currently advertised as FedRAMP-authorized, CMMC-certified, SOC 2-certified, or approved for classified information. ACE may help customers manage audit and evidence workflows, but it does not replace required compliance assessments, certifications, audits, legal advice, or customer responsibility for security controls.

Healthcare use cases should focus on administrative workflows first and should avoid patient data or PHI unless customer-specific controls, approvals, contractual terms, and validations are in place.

14. Incident Response

EverRise maintains internal procedures for reviewing suspected security issues affecting ACE Platform, EverRise-controlled systems, or agreed implementation activities. In a BYOC deployment, customers should also maintain their own incident response procedures for their cloud, identity, network, logging, backup, and production environments.

If an incident affects both EverRise-controlled components and a customer-controlled environment, EverRise and the customer should coordinate response activities according to the applicable written agreement, security addendum, or support process.

15. Responsible Disclosure

If you believe you have identified a security vulnerability affecting the EverRise Systems website, ACE Platform, or related EverRise-controlled materials, please report it to contact@everrisesystems.com with enough detail to help us understand and reproduce the issue.

Please do not access, modify, delete, exfiltrate, or disclose data that does not belong to you. Please give EverRise a reasonable opportunity to investigate and address a report before making public disclosures. EverRise does not currently operate a paid bug bounty program.

16. Contact

Security-related questions, procurement questionnaires, platform assessment requests, and responsible disclosure reports may be directed to EverRise Systems Inc. using the contact information below.

Do not send classified information, Controlled Unclassified Information, protected health information, credentials, secrets, sensitive procurement data, or confidential third-party information through public website forms or ordinary email.