Continuum API

Security Exhibit

Version 1.0 — Effective August 28, 2026

This Security Exhibit describes the technical and organizational measures ("TOMs") Continuum implements to protect Customer data processed under the Data Processing Agreement. These measures represent the minimum standard; Continuum may implement additional controls at its discretion.

1. Infrastructure and hosting

  • Cloud providers: Railway (application servers, worker processes) and Supabase (PostgreSQL database), both running on AWS in the United States.
  • Encryption in transit: All API traffic is encrypted with TLS 1.2 or higher. HTTP requests are redirected to HTTPS. Internal service-to-service traffic uses encrypted connections.
  • Encryption at rest: Database volumes (Supabase/AWS RDS) are encrypted at rest using AES-256. Railway persistent volumes use encrypted storage.
  • Network isolation: Application servers communicate with the database over private networks; the database is not publicly accessible.

2. Access control

  • Authentication: All customer-facing authentication is handled by WorkOS (SOC 2 Type II certified). Employees access production systems via SSO with MFA enforced.
  • Least privilege: Production access is restricted to personnel who require it to perform their role. Access rights are reviewed quarterly.
  • API key security: API keys are hashed (SHA-256) before storage. Only key prefixes are stored in plaintext for identification. Keys are never logged in full.
  • Admin access: Direct database access requires a separate authenticated session and is logged.

3. Application security

  • Input validation: All API inputs are validated against strict schemas before processing. SQL operations use parameterized queries exclusively.
  • Rate limiting: API endpoints enforce per-key rate limits to prevent abuse and denial of service.
  • Dependencies: Third-party dependencies are monitored for known vulnerabilities. Critical patches are applied within 30 days of disclosure.
  • Secrets management: Credentials and secrets are stored in Railway's encrypted environment variable store and are never committed to source control.
  • Row-level security: Database RLS policies ensure each customer can only access their own data.

4. Data handling

  • Data minimization: Continuum stores only data necessary to provide the service. Verification results are retained for 90 days by default; bulk job data is retained for 30 days.
  • Backups: Database backups are performed daily by Supabase with point-in-time recovery enabled. Backup data is encrypted and stored in a separate AWS region.
  • Data deletion: Customer data is deleted within 30 days of account termination. Individual deletion requests are processed within 30 days.

5. Incident response

  • Monitoring: Application errors, anomalous API usage, and infrastructure metrics are monitored continuously via automated alerting.
  • Breach notification: Confirmed data breaches affecting Customer personal data are reported within 72 hours of discovery, as required by GDPR Article 33 and applicable law.
  • Incident log: Security incidents are logged, investigated, and remediated with root-cause analysis documented internally.

6. Organizational measures

  • Security training: Personnel with access to production systems complete security awareness training annually.
  • Vendor review: Subprocessors are reviewed for security posture before engagement. The current subprocessor list is maintained at continuumapi.com/legal/subprocessors.
  • Penetration testing: Continuum conducts or commissions penetration tests at least annually. Test reports are available to enterprise customers under NDA.

7. Compliance

Continuum is working toward SOC 2 Type II certification. The current compliance status and Trust Center are available at trust.continuumapi.com. Enterprise customers may request a copy of the most recent audit report under NDA by emailing security@continuumapi.com.

8. Contact

Security inquiries and vulnerability disclosures: security@continuumapi.com.