Identity
Role-based access, service identities, least privilege and separation of human from machine authority.
07
Security & Privacy
An AI system inherits every permission it can reach.
Our security approach treats prompts, retrieval, models, tools and identities as one attack surface. Authority is constrained before intelligence is added.
PUBLIC DISCLOSURE / v1.1
Secure-by-architecture baseline
This page describes Morifar's intended delivery standard. The public Decision Instrument additionally enforces same-origin access, bounded JSON input, rate limits, a safe request timeout, server-side secrets and strict structured-output validation. Specific controls, hosting regions, vendors and contractual commitments are confirmed per engagement. This is not an ISO certification, SOC attestation or independent audit.
Data
Purpose limitation, source permissions, minimisation, retention design and controlled retrieval.
Models
Approved providers, use-case constraints, prompt-injection controls and documented fallback behaviour.
Tools
Allowlisted actions, typed inputs, scoped credentials, transaction limits and confirmation gates.
Software
Peer review, dependency control, secret handling, environment separation and change traceability.
Operations
Logging, alerting, incident classification, containment, recovery and post-incident corrective action.
DATA LIFECYCLE
Every data flow needs a purpose, owner and exit.
Identify lawful purpose and minimise inputs.
Enforce identity and source permissions at retrieval time.
Protect data in transit and limit processor exposure.
Apply defined retention and deletion requirements.
Preserve appropriate audit records without replicating sensitive content.
Report a suspected vulnerability responsibly.
Send a concise description, affected surface and reproduction information. Do not include client data or exploit production systems. We will acknowledge valid reports and coordinate remediation according to severity.
ai@morifar.com