JSON Holdings LLC

Security Policy

How JSON Holdings LLC (d/b/a IsotopeReady) protects your nuclear compliance data in IsotopeReady.

Last updated: March 24, 2026

Our Security Commitment

IsotopeReady handles sensitive nuclear supply chain data — bid values, compliance certifications, HALEU traceability records, and ITAR-adjacent documentation. We treat security not as a checkbox but as a core operational requirement. This document describes the technical and organizational controls we maintain to protect your data.

For security vulnerability reports, contact [email protected]. We commit to acknowledging reports within 48 hours and resolving critical vulnerabilities within 7 days.

Infrastructure Security

Hosting & Network

  • ▸All services hosted on SOC 2 Type II certified cloud infrastructure (AWS / Azure)
  • ▸Network traffic isolated using Virtual Private Cloud (VPC) with private subnets for database and worker services
  • ▸Web-facing services protected by a Web Application Firewall (WAF)
  • ▸DDoS protection at the network edge
  • ▸All inter-service communication restricted to internal network — database ports are never exposed to the public internet
  • ▸Production and staging environments fully isolated

Database Security

  • ▸PostgreSQL with row-level tenant isolation — each tenant's data is filtered at the query level
  • ▸Database instances accessible only from application servers within the private subnet
  • ▸Automated encrypted backups with point-in-time recovery (30-day retention)
  • ▸Database credentials rotated quarterly and managed via environment secrets (never committed to source code)

Document Storage

  • ▸Uploaded compliance documents stored in Azure Blob Storage with private access policies
  • ▸All stored documents encrypted at rest using AES-256
  • ▸Presigned URLs with short expiry (15 minutes) used for document access — no persistent public URLs
  • ▸OCR raw text stored encrypted in database; original files retained per compliance retention requirements

Application Security

Authentication

  • ▸Passwords hashed using bcrypt with minimum cost factor 12
  • ▸JSON Web Tokens (JWT) used for session management with 8-hour access token expiry
  • ▸Refresh tokens issued separately with 30-day expiry, rotated on use
  • ▸Optional two-factor authentication (2FA) per user — strongly recommended for ShopAdmin accounts
  • ▸Account lockout after 10 consecutive failed login attempts
  • ▸All authentication events logged with IP address and user agent

Authorization & Access Control

  • ▸Role-based access control (RBAC): SystemAdmin, ShopAdmin, ShopUser, Auditor
  • ▸Tenant isolation enforced at the ORM layer via global query filters — cross-tenant data access is architecturally impossible
  • ▸Admin impersonation is time-limited (1 hour), requires SystemAdmin role, and generates an immutable audit log entry
  • ▸API keys scoped to tenant and user context — no super-user API keys issued to customers

Data Transmission

  • ▸All traffic encrypted with TLS 1.3 — TLS 1.0 and 1.1 disabled
  • ▸HSTS (HTTP Strict Transport Security) enforced with 1-year max-age
  • ▸API responses include security headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options
  • ▸Webhook payloads signed with HMAC-SHA256 — receiving systems can verify authenticity

Input Validation & Injection Prevention

  • ▸All API inputs validated using Pydantic schema validation before any database interaction
  • ▸SQLAlchemy ORM used exclusively — parameterized queries, no raw SQL string interpolation
  • ▸Uploaded files validated for MIME type and scanned before OCR processing
  • ▸File size limits enforced at the API layer (50MB max per upload)

Audit Logging

IsotopeReady maintains comprehensive audit logs to satisfy NQA-1, 10 CFR 50 Appendix B, and ITAR recordkeeping requirements. Every audit log entry is immutable — no application user or administrator can modify or delete audit records.

  • ▸All authentication events (login, logout, failed attempts, 2FA challenges)
  • ▸All data creation, modification, and deletion events with before/after values
  • ▸All compliance check executions with results
  • ▸All document uploads with file metadata
  • ▸All admin actions including tenant suspension and user impersonation
  • ▸All API key generation and webhook configuration changes
  • ▸IP address, user agent, and timestamp recorded for every event
  • ▸Audit logs retained for 7 years minimum

Auditor role users have read-only access to all audit logs within their tenant, facilitating external compliance audits without requiring ShopAdmin privileges.

OCR & AI Processing Security

IsotopeReady processes compliance documents through an OCR pipeline (Tesseract). Security controls for this pipeline:

  • ▸OCR processing runs in isolated worker containers with no internet access
  • ▸Uploaded files are never sent to third-party AI or cloud OCR services — processing is entirely on our infrastructure
  • ▸Extracted text and fields are stored only within your tenant's data partition
  • ▸OCR confidence scores are logged — documents below 70% confidence are flagged for manual review rather than auto-processed

Vulnerability Management

Dependency Security

  • ▸Backend (Python/FastAPI) and frontend (Next.js) dependencies scanned weekly for known vulnerabilities
  • ▸Critical and high-severity CVEs patched within 7 days of disclosure
  • ▸Container base images updated monthly and on critical CVE disclosure

Penetration Testing

We conduct annual third-party penetration tests of the IsotopeReady platform. Findings are remediated according to severity: Critical within 24 hours, High within 7 days, Medium within 30 days. Test reports are available to Premium tier customers under NDA upon request.

Responsible Disclosure

We welcome responsible disclosure of security vulnerabilities. To report a vulnerability:

  • ▸Email [email protected] with a detailed description
  • ▸Include steps to reproduce, affected components, and potential impact
  • ▸Allow us 90 days to remediate before public disclosure
  • ▸Do not access, modify, or delete data belonging to other users
  • ▸We commit to acknowledging your report within 48 hours and providing regular updates

Business Continuity & Disaster Recovery

  • ▸Recovery Time Objective (RTO): 4 hours for full platform restoration
  • ▸Recovery Point Objective (RPO): 1 hour maximum data loss (hourly database snapshots)
  • ▸Automated database failover with multi-availability-zone deployment
  • ▸Documented incident response playbooks for security events, data breaches, and infrastructure outages
  • ▸Annual disaster recovery exercises conducted and documented

Compliance Certifications

IsotopeReady operates under or works toward the following security standards:

  • ▸SOC 2 Type II: Infrastructure providers certified; IsotopeReady application SOC 2 assessment planned for Q4 2026
  • ▸NIST Cybersecurity Framework: Security controls mapped to NIST CSF v2.0 Identify, Protect, Detect, Respond, Recover functions
  • ▸ITAR Technology Control: Platform access controls designed to support customer ITAR Technology Control Plans
  • ▸10 CFR 50 Appendix B: Audit trail and document control features aligned with nuclear QA recordkeeping requirements

Employee Access & Training

  • ▸All JSON Holdings LLC employees undergo background checks prior to access to production systems
  • ▸Production data access is limited to personnel with documented business need
  • ▸Security awareness training conducted annually
  • ▸All employee access to customer data generates an audit log entry
  • ▸Employee offboarding includes immediate revocation of all access credentials

Contact

For security inquiries, vulnerability reports, or to request our security documentation:
Email: [email protected]

JSON Holdings LLC (d/b/a IsotopeReady)
United States