This page describes the controls we have shipped and the ones we have not. We do not claim audits we have not passed.
What is roadmapped is marked as such. Vendor questionnaires are welcome. We update this page as controls ship, not on a fixed calendar.
Vulnerability disclosure
If you find something, tell us. We do not litigate good-faith research.
Email [email protected] with a description, reproduction steps, and a handle if you want credit. We acknowledge receipt within 24 hours and aim to triage within 5 business days.
We do not pursue legal action against researchers who:
- Do not access, modify, or exfiltrate customer data beyond what is needed to demonstrate the issue
- Do not degrade service availability for other customers
- Give us reasonable time (default 90 days) to fix before public disclosure
A paid bug bounty is not live. We credit researchers publicly when their fix ships.
Controls matrix
In place means shipped and ready for review today. Roadmap means planned, with an ETA. Not yet means no committed timeline.
Authentication
| Control | Detail | Status |
|---|---|---|
| Bcrypt-hashed passwords + HS256 session JWTs | Passwords are never stored in plaintext. Sessions are short-lived and refresh on activity. SSO/SAML is on the roadmap. | In place |
| OAuth-only social posting (no password capture) | X, LinkedIn, Instagram, YouTube, and TikTok use platform-native OAuth. We never see, store, or proxy customer social passwords. | In place |
| API keys are scoped and revocable | sk_live_* / sk_test_* keys carry explicit asset_type, channel, daily_limit, and auto_post scopes. Only a SHA-256 hash is stored. Plaintext is shown once at mint, never again. | In place |
| SSO / SAML | Not implemented. On the roadmap after the Stripe billing flow. | Roadmap · eta v1.5 |
Storage
| Control | Detail | Status |
|---|---|---|
| Encryption at rest (Postgres + R2) | Postgres data is encrypted at rest on our database host. R2 uses Cloudflare's standard server-side encryption. Customer drafts are not written to the local filesystem outside the worker's scratch space. | In place |
| Connected-account tokens encrypted in the database | OAuth tokens for X, LinkedIn, Instagram, YouTube, and TikTok are encrypted at rest with Fernet. Keys can be rotated. Disconnecting a platform wipes the token immediately. | In place |
| TLS 1.2+ in transit | All public endpoints sit behind Cloudflare with TLS 1.2 as the minimum. HSTS is preloaded. | In place |
| Customer-managed encryption keys (CMEK) | Not implemented. Planned alongside SSO. | Not yet |
Brand DNA
| Control | Detail | Status |
|---|---|---|
| Server-locked slogan + required disclaimers | Slogan and disclaimer text are stamped at the renderer, where the language model has no write access. Drift is a structural failure, not a prompt-compliance hope. | In place |
| Banned-word enforcement at two stages | The Reasoner refuses to draft banned terms. The renderer post-processes copy to flag any that slip through. The customer sees a flagged verdict, not a silent violation. | In place |
Operations
| Control | Detail | Status |
|---|---|---|
| Workspace isolation | Brand Memory and connected accounts are scoped per workspace. Multi-brand agencies do not cross-pollinate. Disconnect a workspace and its memory deletes with it. | In place |
| Audit logs per dispatch | Every post dispatch creates an audit row: prompt, asset, post URL, timestamp. Admins can see these in the dashboard. | In place |
| Draft handling and inference | Drafts and generation runs stay on Siren's private network except when the Reasoner calls the Anthropic API. Those calls include workspace_id metadata only. Anthropic's API zero-retention policy applies on our tier. | In place |
| Status page + uptime monitoring | status.mysiren.ai tracks availability. Uptime Kuma monitors it in real time. | In place |
| SOC 2 Type II | On the roadmap. We are not buying a pre-revenue audit. We will not claim SOC 2 until a report is signed. | Roadmap · eta post-revenue |
| Penetration testing reports | Planned for Q3 2026. We will share results with customers under NDA once a third-party report is on file. | Roadmap · eta Q3 2026 |
| Bug bounty program | Not launched. We still honor good-faith disclosure (see above) and credit researchers when fixes ship. | Not yet |
Data handling
For each customer workspace, we store:
- Brand DNA. Colors, fonts, logo, archetype, banned words, required disclaimers. Editable. Revision history is kept for 90 days.
- Generation runs. Prompt, seed, asset URL, posting metadata. Deletable per row by the customer.
- Brand Memory. Pgvector-indexed approved drafts, on Pro and above. Kept while the workspace is on a plan that writes it, and deleted with the workspace.
- OAuth tokens. Encrypted at rest, scoped to the declared platforms, wiped on disconnect.
- Audit logs. Dispatch history, sign-ins, scope changes. Retention is tier-bound.
Customers can opt out of model-improvement use of their drafts in Settings → Privacy & Data (the users.training_opt_out flag). When opted out, the draft is generated and stored for that customer. It is not sampled into training datasets.
Account deletion wipes all of the above. We retain billing records because the law requires it, and aggregate usage metrics with no personal data and no draft contents.
Subprocessors
The third parties Siren routes data through:
- Anthropic. LLM inference for the Reasoner. Drafts are sent with workspace_id metadata only. Anthropic's API zero-retention policy applies on our tier.
- Cloudflare R2. Object storage for rendered assets. Encrypted at rest.
- Stripe. Payment processing. PCI scope is minimized via Stripe Checkout. We never see card details.
- Resend. Transactional email (signups, password resets, billing receipts).
- Siren infrastructure (private VPS). Runtime and Postgres. EU and US regions.
The full list, with contracting entity, data categories, and region, is at /subprocessors.
Vendor questionnaire?
Email [email protected] with the questionnaire attached. We respond within 5 business days. Ask and we send the DPA and the subprocessor list together.
