Security & Architecture
We build cognitive tools for decisions you would want an auditor to inspect. Here is how our infrastructure, identity, and execution boundaries work in production today — and what we do not claim.
Edge & Transport
Traffic passes through an AWS WAF at the CloudFront global edge and a second, regional AWS WAF in front of our Application Load Balancer. All connections require TLS 1.2+ in transit and encryption at rest in AWS.
Independent Token Verification in Every Engine
Our Application Load Balancer is a pure TLS-terminating passthrough. Every MCP reasoning service independently validates HS256 session JWTs at the service boundary before executing any tool call — eliminating central auth chokepoints and isolating fault domains.
No Passwords to Leak
You sign in exclusively through Google, GitHub, or Apple via AWS Cognito. We never collect, hash, or store user passwords.
OAuth 2.1 with PKCE and Client ID Metadata Documents
Every remote MCP connector authenticates via OAuth 2.1 with PKCE (S256) against a single canonical issuer (https://reasoning.services). We support Client ID Metadata Documents (client_id_metadata_document_supported: true) per the MCP 2026-07-28 authorization specification, while retaining Dynamic Client Registration (DCR) as a fallback for older clients.
Your Sessions, Your Inputs, and Our Telemetry Boundary
- Model inference: Reasoning engines that invoke foundation models run on AWS Bedrock (
us-east-1), where customer inputs and outputs are never used to train foundation models or shared with model providers. - Session state: Active reasoning sessions are stored encrypted at rest in AWS DynamoDB (
mcp_sessions) so your agent can resume multi-step chains. - Operational telemetry: Service telemetry records keyed HMAC-SHA256 pseudonyms (
user_id_hash,tenant_id_hash,session_id_hash) and derived numerical/categorical metrics (latency, step counts, quality scores) — never raw prompt or response text. No customer data is used to train models today. We never sell your data.
Built from Source; Explicit When Incomplete
All 10 reasoning engines are built from source from internal AWS CodeCommit repositories with zero vendored binary wheels. Deterministic solvers such as formal-logic return a machine-verified proof or countermodel with no confidence score. When a multi-perspective tool hits a per-perspective timeout, it emits an explicit PARTIAL ANALYSIS — NOT COVERAGE banner rather than returning silent partial results.
What We Do Not Claim
We do not hold SOC 2 or ISO 27001 certifications, and we do not currently offer enterprise SAML/OIDC SSO. When those milestones change, the artifacts will be linked here.
Vulnerability Reporting
To report a security vulnerability, email support@reasoning.services or compliance@reasoning.services (or reach us via our contact page). Our machine-readable disclosure policy is published at /.well-known/security.txt.