BLUEPINKSECURITY INC. / PUBLIC LEGAL DOCUMENT

Trust Center

Security, privacy, AI governance and evidence

1. Our security thesis

Bluepinksecurity Inc. is building organizational superintelligence with intelligence and cybersecurity engineered together. Our engineering premise is that dependable systems require governance, independent checks and enforceable boundaries around probabilistic AI capabilities. We work toward defense in depth, scoped authority, verifiable trust and responsible deployment. This approach recognizes residual risk and requires evidence before a research hypothesis can be presented as a production guarantee.

2. Scope of this Trust Center

This public Trust Center explains the principles governing BPS's institutional website and TIAP, our conversational AI agent and interactive orb, along with the framework used to evaluate future commercial systems. Individual products, hosted services, customer environments and research concepts may have different security responsibilities and maturity. A security claim applies only to the identified system and deployment scope. Commercial commitments are documented in the applicable agreement.

3. TIAP and visitor transparency

TIAP identifies itself as an AI conversational system. Visitors determine whether to begin a session and may use the available contact route for enquiries. The voice service currently runs on the voice-processing provider with voice recording disabled, audio deletion enabled and a 30-day conversation-retention setting. Personal information, transcripts and any externally exported follow-up records have their own applicable handling requirements, described in the Privacy Policy. Any material change in voice recording, retention or use of data will be evaluated and disclosed as required.

4. Privacy by design

The institutional website is designed without advertising cookies or visitor profiling pixels. TIAP seeks only information relevant to the enquiry, such as language, enquiry category, optionally confirmed contact details and the request itself. Optional marketing communications are managed separately from permission for a specific reply. BPS provides means to object to marketing and exercise statutory privacy rights. Sensitive documents, credentials and confidential third-party information are inappropriate for the public conversational interface.

5. Engineering control domains

BPS assesses systems using connected security domains that include human accountability, identity assurance, agent trust, workforce permissions, supplier trust, access authorization and compliance evidence. Relevant technical safeguards can include strong authentication, least-privilege access, cryptographic controls, network and application protection, segmented service boundaries, incident monitoring, authorized tool execution and human oversight for consequential actions. The presence of a control in our engineering framework indicates a security objective; a statement that it is implemented requires deployment-specific verification.

6. XC research and independent enforcement

Xyqar Core (XC) is the proposed open, independently usable foundational trust layer in BPS's research and architecture. Its purpose includes verifiable identity, scoped agent authority, validation of reported information and minimization of sensitive data exposure across boundaries. It is designed to contribute to complementary protection layers and to operate within different deployment patterns as implementations mature. Research direction, standardization work, released open components and enterprise-grade commercial assurances have distinct stages and require their own evidence. Probabilistic models do not independently grant themselves execution authority.

7. Governance of external providers

Voice processing, hosting, inference, communications and other external services are assessed according to the role they play, the data they receive, their contractual terms, security posture, transfer mechanisms, access controls and retention settings. A specialist voice processor supports the TIAP interface. BPS does not characterize another company's certification as a certification of BPS. We review material provider changes and the relevant data handling disclosures.

8. Responsible AI operations

We aim to identify AI-generated interactions clearly, test limitations, prevent unsupported claims of completed actions, restrict access to external tools and require human confirmation for actions with consequential business effects. Models may produce errors, and research evaluations should measure reliability, security and failure modes for the intended context. Automated conversational assistance is distinct from an authorized commercial commitment, a hiring decision or a regulatory determination.

9. Security operations and vulnerability reporting

Our security work addresses vulnerability intake, prioritized remediation, access review, incident triage, containment, recovery and legally required notification. Security, privacy and responsible vulnerability disclosure enquiries may be sent to dpo@bluepinksecurity.com with an appropriate subject. Good-faith reporting is welcomed, while access to protected systems or intrusive testing requires written authorization. Processor incident obligations are governed by the relevant signed DPA and services agreement.

10. Independent assurance and claim integrity

BPS publishes certifications, audit opinions, regulatory approvals or formal conformance results only after their independent verification, including the issuer, dates, covered entity, services and scope. No ISO 27001 certificate, SOC 2 report, post-quantum certification or service uptime undertaking is implied by this Trust Center. Where evidence is available and can lawfully be shared, qualified customers may request scoped security documentation under suitable confidentiality protections.

11. Related documents and contact

Privacy Policy: https://bluepinksecurity.com/legal/privacy. Website & AI Interaction Terms: https://bluepinksecurity.com/legal/terms. Cookies Policy: https://bluepinksecurity.com/legal/cookies. Data Processing Addendum: https://bluepinksecurity.com/legal/dpa. Trust Center: https://bluepinksecurity.com/legal/trust-center. For security, privacy, supplier assurance and related governance enquiries, email dpo@bluepinksecurity.com. Last updated: 18 October 2026.

ISSUED BY BLUEPINKSECURITY INC.

Data protection and legal enquiries: dpo@bluepinksecurity.com

Last updated: 18 October 2026