Trust Center
Causa Prima builds agentic AI for the CFO office. Our production environment runs on Google Cloud in the EU. Select Get access to request our security documents; questions go to security@causaprima.ai.
Trust Center Updates
Sub-processor list published
Causa Prima now publishes its complete sub-processor list on this Trust Center.
This is the canonical list referenced by our Data Processing Agreement. For each sub-processor it names the service provided and the processing location.
This notice establishes the list as published; it does not announce a change. Going forward, any addition, removal or change of processing location will be posted here at least 15 days before it takes effect, together with the effective date and how to object.
Subscribe to this Trust Center to receive those notices. Questions or objections: security@causaprima.ai
Subprocessors
Data Security
Our policies require encryption of all data in transit (TLS) and at rest, daily encrypted backups within the EU, and deletion of identifiable customer data after the relationship ends unless the law requires us to keep it.
App Security
Our SDLC Policy requires every production code change to be reviewed before merge by an identity other than its author, with human approval for security-sensitive areas. An independent penetration test runs at least annually; our 2026 test is performed by Sensiba.
Access Control
Our policies require least-privilege access, quarterly access reviews and removal of access at offboarding. Authentication is passwordless-first (SSO, passkeys), with MFA or an equally strong method required for all access.
Infrastructure
Production runs on managed Google Cloud services in the EU, with configuration defined as code. We operate no data centres or network hardware of our own.
Policies
Our information security policies, aligned with SOC 2 and ISO/IEC 27001, are approved and published to our team. Copies are available on request.
Incident Response
We maintain a documented Incident Response Plan with defined roles and escalation paths, led by our Security Officer. We are happy to provide more details about our incident response practices upon request.
Risk Management
Our Security Officer runs a documented risk management process covering risk assessment and treatment. We are happy to provide more details about our risk management practices upon request.
BC/DR
Our Business Continuity and Disaster Recovery Plans provide for restoring production in another EU Google Cloud region from code and backups, and require testing at least annually.