Security & Vulnerability Disclosure

Continuous LLC (cntnus) engineers applications around data minimization, tenant isolation, cryptographic security, and an on-demand $0 idle baseline.

Security Baseline & Controls

• Encryption: All customer data is encrypted in transit using TLS 1.2+ and at rest using AWS KMS with automatic key rotation.
• Tenant Isolation & Least Privilege: Fine-grained IAM policies, isolated per-tenant storage keys, and scoped Cognito authentication with adaptive auth.
• Threat Detection: Continuous monitoring via AWS GuardDuty, AWS Config managed rules, and regional API Gateway rate-limiting.
• Audit Logging: Centralized immutable CloudTrail logging in a dedicated audit account with strict log retention caps.
• Data Sovereignty: Canvases and documents are local-first with full data portability (NDJSON, SVG, and zoom-flight video export).

Vulnerability Reporting (RFC 9116)

We welcome responsible vulnerability disclosures from security researchers. Our standardized disclosure policy is published at /.well-known/security.txt.

• Contact: security@cntnus.app
• Preferred Language: English
• Safe Harbor: If you conduct vulnerability research in good faith and in accordance with our Acceptable Use Policy, we will consider your activities authorized and will not pursue legal action against you.

Compliance Frameworks

Frond's infrastructure and development controls are designed against SOC 2 Type II Trust Services Criteria and HIPAA Security Rule safeguards. For detailed control matrices and architecture specifications, consult our compliance documentation.