Posture, stated without decoration.
This page is written to be checked. It describes how the systems we build are secured, and it names what this division does not hold — because the second half is what tells you whether the first half is honest.
Six controls, by construction.
-
Least privilege by construction
Every credential is scoped to one job, short-lived, and issued per action or per run. Secrets live in a managed store — never in code, never in a log, never shared between risk tiers.
-
Approval gates that cannot self-satisfy
Material actions route to a named human. The system cannot approve on their behalf under any condition, including timeout. A timeout escalates.
-
Immutable audit
Proposal, classification, approver, payload, result — written append-only. The record exists to answer a question weeks later, which is the only time anyone asks it.
-
Read-only by default
Integrations extract through published APIs with read scopes. Write access is a separate decision, separately credentialed, and it is never the default.
-
Data minimisation in telemetry
Sensitive payloads are referenced by hash rather than copied into traces. Observability should not become a second copy of your data.
-
Tested reversal
Anything material has a defined way back, exercised in staging. No reversal path, no unattended execution.
What we hold and what we do not.
MIDIOS Technologies holds no security certifications or attestations at this time — no SOC 2, no ISO 27001, no FedRAMP authorisation. Stating that plainly is more useful to you than a page of security-adjacent language that implies otherwise.
Where an engagement requires a certification we do not hold, we will say so early and either propose teaming with a party that holds it or decline. We will not represent ourselves as a certified assessor, an offensive security practice, or an accredited auditor, because we are none of those.
The architecture and access model of the internal systems running the MIDIOS group are not published. That is a security decision rather than a marketing one. Technical and institutional partners can review the detail under NDA.
For institutional and government buyers.
| Provided on request | Entity and registration detail, insurance position, security questionnaire responses, architecture review under NDA, named technical point of contact, and references from within the MIDIOS group where relevant. |
|---|---|
| Not asserted | Past performance we do not have, certifications we do not hold, clearances not granted, or set-aside eligibility not determined. |
| Posture | MIDIOS Technologies is a recently established division. On work requiring a past-performance record we would expect to team rather than prime, and we would rather say that at the first conversation than at diligence. |
| Vulnerability reports | Send to security@midios.one. A formal disclosure policy and response-time commitment will be published here before any public API ships. |