Security Policy

IsotopeReady handles sensitive nuclear supply chain data — bid values, compliance certifications, HALEU traceability records, and ITAR-adjacent documentation. We treat security not as a checkbox but as a core operational requirement. This document describes the technical and organizational controls we maintain to protect your data.

For security vulnerability reports, contact [email protected].

• ▸Hosted on a managed server in the United States
• ▸All traffic encrypted in transit (TLS), with HTTPS enforced
• ▸Access to production systems restricted to authorised staff
• ▸Application secrets are never committed to source code

• ▸Passwords stored only as salted one-way hashes
• ▸Optional two-factor authentication per user, strongly recommended for administrator accounts
• ▸Role-based access control, with each customer's data scoped to that customer's organisation
• ▸Uploaded files checked by their actual content against an allow-list of permitted types, with a size limit
• ▸Outgoing webhook payloads signed so receiving systems can verify them

Uploaded documents are processed on our own server. The optional AI executive-summary feature, when enabled, sends a bid's summary details, such as its title, figures and failed-requirement notes (not your uploaded documents), to a third-party AI provider to write the summary.

We welcome responsible disclosure of security vulnerabilities. To report a vulnerability:

• ▸Email [email protected] with a detailed description
• ▸Include steps to reproduce, affected components, and potential impact
• ▸Allow us 90 days to remediate before public disclosure
• ▸Do not access, modify, or delete data belonging to other users

For security inquiries, vulnerability reports, or to request our security documentation:
Email: [email protected]

IsotopeReady is a registered Ohio trade name of JSON Holdings LLC
United States