Compliance and Security Overview
This Trust Center provides transparent visibility into Twelfth AI Pty Ltd's security, compliance, governance, and trust documentation, giving your procurement and security teams everything they need in one place.
SOC 2 Type 2
ISO 27001
Third parties that process data on our behalf under strict contractual safeguards.
Anthropic
Claude Code, run on developer laptops, writes the majority of code changes. Repository contents and local context are sent to Anthropic during development. Claude models are also available through Google Vertex AI for product inference, which is governed under the Google Cloud record rather than here. No customer production data is deliberately sent, but source code and infrastructure configuration are, and every output still reaches production only through pull request and CI. CORRECTION 2026-09-11 - the DPA position on this record was wrong. Claude Code runs on individual Max subscriptions, which are governed by Anthropic's CONSUMER Terms. The Anthropic DPA is incorporated through the COMMERCIAL Terms section C, so it does not reach this usage: there is no processor agreement covering Claude Code today. The confirmation this record asked for on 2026-09-10 came back negative. A separate Anthropic Console / API relationship exists on commercial terms for headless and automated work, and that one does carry the DPA - do not conflate the two. Staying on individual subscriptions is a deliberate cost and velocity decision, not an oversight: metered token billing for five engineers doing agentic coding is unbounded, and a heavy day can exceed a month of subscription. It is recorded as EXC-2026-001 with compensating controls and a six-month expiry. On consumer plans, model training is a per-user setting rather than a tenant policy, so our assurance that it is off is attestation plus a dated screenshot at each access review. There is no admin console enumerating these accounts, so the account inventory is hand-maintained. The earlier claim on this record that laptops are 'managed' has also been softened: there is no MDM and engineers hold administrative rights, as the Approved Software Register states. Still assessed as NOT a sub-processor, and the reason is specific: no customer production data or personal data is sent. The exposure is intellectual property - a compromise would disclose how the product is built, not customer records. If a tool is ever pointed at customer data this assessment is void. Standard: 03-ops/security/ai-coding-tools.md. Finding: ISA-2026-014.
Attio
Customer relationship management: the record of pipeline, prospects and commercial relationships. Holds personal data - names, business email addresses, job titles and meeting notes for contacts at retailers, prospects and investors - but twelfth is the controller of that data rather than a processor acting for a customer, so it is not a sub-processor. It holds no product data and no workspace records; a buyer's activity inside the platform is not synced here. The exposure is commercial and regulatory rather than operational. A compromise would disclose the pipeline, the identity of prospects and design partners, and the contact details of named individuals at those organisations - a GDPR matter for the individuals and a competitive one for twelfth, but not a route into the platform or to customer records. SECURITY REVIEW COMPLETED 2026-09-14 by Murtaza (owner). Plan: Free. Sign-in: Google or email one-time code; SAML SSO/SCIM are Enterprise-only and not available. twelfth.ai domain verified in Attio 2026-09-14. Members: three, all Admin (murty@, mark@, michael@ invite pending); no leavers hold seats. Integrations: Mailchimp and Mixmax were installed and not in use; both uninstalled 2026-09-14. Access tokens: none. Webhooks: none. Call Intelligence not set up; automatic enrichment on by default (covered by Attio's DPA and sub-processor list). Retention rule: contact records kept for the life of the relationship plus two years after last interaction, then deleted; leavers' synced mail deleted at suspension; reviewed each September. Contract: Attio's DPA (https://attio.com/legal/attio-data-processing-addendum, Feb 2026) forms part of the Customer Agreement and binds by reference. Production on Google Cloud, EU. 14 sub-processors incl. OpenAI, Anthropic, Clearbit, FullContact; 30 days' notice of additions. ISO 27001:2022 per trust.attio.com. Scores: inherent possible / moderate; residual possible / minor. Residual likelihood does not move because access runs through Google Workspace sign-in, which inherits ISA-2026-008 (2SV enrolled, not enforced). Evidence: comments on this record and 03-ops/security/vendor-evidence/attio-*.png; reasoning in 03-ops/security/vendor-register-2026-09.md, addendum 2026-09-14.
Blacksmith
Managed GitHub Actions runners, and the default runner for 13 of the 15 workflows in the main repository - including ci.yml, which is the gate on every pull request, railway-iac.yml, which applies infrastructure changes, and every deploy workflow. That reach is what makes this consequential rather than routine. The approved software register states that no software reaches a production system except through pull request, code review and CI; Blacksmith is where that CI executes. A job running on its runners sees repository contents on checkout, the secrets exposed to that workflow (including the credentials that deploy to Railway and apply infrastructure as code), and the artefacts that autodeploy from the default branch. No customer data passes through it. Vendor evidence, reviewed 2026-09-11: SOC 2 Type 2, audit and observation period complete September 2024 (Type 1 May 2024). Each job runs in its own Firecracker microVM with KVM hardware isolation and all state destroyed on completion, so runners are single-use per job and one workflow's secrets are not observable by the next. Blacksmith's GitHub App does not itself have access to repository secrets; secrets reach the runner only at job time through GitHub's normal mechanism. Runner region is set to US West in the account settings; other regions are not yet offered. Controls on our side, verifiable in the repository: Blacksmith's own actions are pinned to full commit SHAs rather than floating tags; branch protection and pull-request review gate what can run; deploys are triggered by a push to the default branch rather than by a runner acting on its own authority. Known operational quirk: the runner image ships Node 20, so workflows needing Node 24 must set it up explicitly. Assessment. Inherent impact major / probability possible. Residual impact MODERATE, not major, for two reasons that are structural rather than written down: the ephemeral-VM model bounds any compromise to a single job's secrets rather than a persistent foothold, and the service is trivially substitutable - every workflow is one runs-on line away from GitHub-hosted runners, so availability loss is an inconvenience rather than an outage. It does not go lower than moderate: while Blacksmith is in the path, a malicious job still sees that job's deploy credentials, whatever the ease of swapping afterwards. Residual probability unlikely on the strength of SOC 2 Type 2, the isolation model and SHA pinning. Open item, not a vendor question: the Blacksmith organisation's primary contact email is a non-twelfth address (drummerduck.com). The account that runs every CI job and holds the deploy path should be owned by a twelfth.ai identity inside Google Workspace SSO and the offboarding process, and the monthly spend alert is currently set to 0 (off).
Cloud infrastructure platform. Hosts the BigQuery data warehouse holding customer commercial data, the scheduled data pipeline that feeds it, and Vertex AI model inference and embeddings. Twelfth does not handle cardholder or payment data.
Cloud productivity and collaboration suite, and the primary identity provider: every staff account, staff mail, and the SSO and account-recovery path into most other systems in this register. Holds no customer data. Two people hold super-admin. Two-step verification is enrolled on all five accounts but not enforced org-wide (ISA-2026-008), which is why residual likelihood does not move; residual impact drops one band because the blast radius is staff mail and onward SSO rather than the customer dataset.