Enterprise Readiness Profile

1. Company Overview

TeNova builds the SWT3 protocol, which generates cryptographic witness anchors for AI inferences, governance decisions, tool access events, and agent handoffs. These anchors are independently verifiable using standard SHA-256. No proprietary tooling is required for verification.

The protocol is designed for regulatory compliance across multiple frameworks simultaneously. A single integration produces evidence that maps to 77 regulatory frameworks, including NIST 800-53, CMMC, EU AI Act, NIST AI RMF, and SR 11-7.

2. Security Posture

2.1 Transport Security

• TLS 1.3 enforced on all public endpoints
• HTTP Strict Transport Security (HSTS) enabled with long-duration max-age
• HTTP/2 enabled across all services
• TLS certificates managed via automated ACME provisioning with auto-renewal

2.2 Vulnerability Management

• Daily automated vulnerability scanning at 04:00 UTC
• Scanner binary is pinned to a specific version with SHA-256 checksum verification before every execution
• Five-layer supply chain audit covers all runtime dependencies
• CVE-to-POA&M automated pipeline with severity-based remediation milestones:
  • Critical: 7-day remediation target
  • High: 30-day remediation target
  • Medium: 90-day remediation target
• Automated overdue flagging and closure tracking
• CISA Known Exploited Vulnerabilities (KEV) feed integrated for priority boost on actively exploited CVEs

2.3 Pre-Deployment Validation

• Nine-layer security gate runs before every production deployment:
  1. Authentication coverage verification
  2. Dangerous code pattern scanning
  3. Shell script linting
  4. SQL injection safety checks
  5. Server hardening validation
  6. STIG alignment checks
  7. CISA KEV exposure assessment
  8. Secret and credential scrubbing
  9. Scan freshness verification
• Integration test suite (31 checks) and multi-provider test suite (56 checks) must pass before deployment proceeds
• If any gate fails, deployment is blocked

2.4 Access Control

• Role-based access control (RBAC) with three roles: admin, analyst, assessor
• Multi-factor authentication (TOTP) available for all accounts
• API keys stored as SHA-256 hashes; raw keys are not recoverable from the database
• Session management via httpOnly, secure cookies
• Row-level security (RLS) enforced on all tenant data at the database level

2.5 Infrastructure Hardening

• Root SSH access disabled; administrative access via unprivileged user with sudo
• Firewall rules restrict inbound traffic to HTTPS and SSH only
• SI-7 integrity monitoring with 24-hour heartbeat verification
• Audit logging (SI-12) for attestations, key management, exports, and login events

3. Data Handling

3.1 What Is Stored

The SWT3 witness ledger stores metadata and cryptographic hashes only. The following table describes what crosses the network boundary and what remains within the customer's infrastructure.

3.2 Clearing Levels

The SWT3 protocol defines four clearing levels for data classification. Customers control which level applies to each witness anchor.

3.3 Tenant Isolation

• All database queries are scoped to the authenticated tenant via a dedicated scoping layer
• Row-level security policies enforced at the database engine level, independent of application logic
• Tenant data is logically isolated; no cross-tenant data access is possible through the application or API

3.4 Data Residency

• All infrastructure is hosted in the United States
• Compute provider: US-based data center with SOC 2 Type II certification
• Database provider: US-based, SOC 2 Type II certified, HIPAA BAA available

3.5 Data Retention

• OPEN tier: 7-day anchor retention
• PRO tier: 90-day anchor retention
• ENCLAVE tier: 1-year anchor retention
• SOVEREIGN tier: Custom retention per contract
• Customers may export all data at any time via API or dashboard

4. Compliance Frameworks

4.1 Supported Frameworks

The SWT3 protocol and Axiom platform support 77 regulatory frameworks through a crosswalk registry. Each accountability procedure maps to one or more framework controls via the registry.

The full list of 77 frameworks is available in the public UCT Registry.

4.2 Accountability Procedures

• 275 accountability procedures across 9 namespaces
• Namespaces: AI, INF, NHI, HBOM, DPP, ADR, FIN, CON, HCF
• Each procedure produces a cryptographic witness anchor with a deterministic fingerprint formula
• Fingerprint formula is locked and verified for cross-language parity across all SDKs

4.3 OSCAL Export

• System Security Plan (SSP) export in NIST OSCAL format
• Plan of Action and Milestones (POA&M) export in NIST OSCAL format
• Assessment Results (AR) export in NIST OSCAL format
• All OSCAL exports validated against the NIST reference implementation before anchoring

4.4 W3C Verifiable Credentials

• Compliance Passport exportable as a W3C Verifiable Credential (Enclave+ tier)
• Ed25519 signing with eddsa-jcs-2022 proof suite
• Issuer DID: did:web:sovereign.tenova.io
• Public verification endpoint available for credential validation
• Revocation status queryable via public API

5. Business Continuity

5.1 Continuity Planning

• Business continuity plan documented and maintained. See Business Continuity Plan for details.
• Daily automated database backups with point-in-time recovery
• Process manager configured for automatic restart on failure
• Health endpoint monitored for service availability

5.2 Key Person Risk Mitigation

• Open protocol specification: github.com/tenova-labs/swt3-ai
• SDKs published to npm, PyPI, crates.io, NuGet, RubyGems, Swift Package Index, and GitHub
• Fingerprint formula and clearing level definitions are locked and documented in the public spec
• Witness anchors are independently verifiable using standard SHA-256; no proprietary tooling required

5.3 Evidence Integrity

• Daily Merkle tree rollups produce a single root hash per tenant per day
• RFC 3161 timestamps from public Time Stamp Authorities provide independent proof of existence
• SI-7 integrity monitoring with 24-hour heartbeat verification
• All exports are SHA-256 signed before delivery

6. Subprocessors

7. API and Integration

7.1 Authentication

• REST API with Bearer token authentication (Authorization: Bearer axm_*)
• API keys are prefixed (axm_) for easy identification in logs and secret scanners
• Keys stored as SHA-256 hashes; the raw key is shown once at creation and is not recoverable
• Session-based authentication available for dashboard interactions (httpOnly secure cookies)

7.2 Rate Limiting

7.3 SDKs and Integration Options

7.4 MCP Integration

• Model Context Protocol (MCP) server with 68 tools for AI tool integration
• MCP discovery files published at /.well-known/mcp.json and /.well-known/agent-card.json
• OWASP MCP Top 10 coverage across all tool categories

7.5 Key API Endpoints

8. SLA Summary

Sovereign tier customers receive a dedicated support channel and custom SLA terms negotiated during the engagement. Contact sales@tenovaai.com for Sovereign tier inquiries.

9. Insurance

10. Contact Information

Related Documents

• Service Level Agreement
• Business Continuity Plan
• Data Processing Agreement
• Enterprise Evaluation Guide
• Service Description
• Clearing Level Addendum
• UCT Registry (280 procedures, 77 frameworks)
• Public Anchor Verification