Verifiable by design. Secure by default.
Every DCS product signs what it does. This page covers how we protect the platform itself, how to report a vulnerability, and where our data lives.
What we do
Cryptography
New R-Series receipts are hybrid: Ed25519 and ML-DSA-65 (FIPS 204) sign the same bytes, and both must hold. The hybrid issuer is release candidate 4, running on staging; ML-DSA-87 follows as an opt-in defence profile. Public-chain anchoring for the current release is in development.
Data
Production data is stored in two regions with failover-only replication; EU users are preferentially stored in the EU. Sovereign customers can run fully air-gapped. We never train models on user content.
Access
Agents and integrations receive scoped, time-bound, revocable permissions through DCS Connector. Every access is receipted. No blanket keys.
Disclosure
Report vulnerabilities to [email protected]. We acknowledge within two business days and publish fixes with credit where the reporter wishes.
Honest status
Independent external security audit of the COSRYX portfolio is not yet completed, and we say so on every COSRYX page. We list what is audited and what is not rather than implying coverage.