Legal — 04

Security & Disclosure

This page is maintained by CALCAR to answer common security questions about the platform. It is a statement of practice, not an independent audit or certification.

[Pending — counsel]

This document is not yet in force. The structure below is in place so counsel can supply the operative text. Nothing on this page should be relied on as a legal agreement or as a statement of current practice.

Verification claims — scope

A CALCAR verification ID identifies a record held by CALCAR. It attests to what the platform recorded and when — not to the conduct of the event itself.
The verification lookup on this site currently returns fictional demonstration records. It is not yet backed by live event data.
No claim of external notarisation, blockchain anchoring, or third-party certification is made anywhere on this site.

Access control

Operator roles, authentication, and least-privilege boundaries.

[Pending — counsel]

Hosting and infrastructure

Where the platform runs and how environments are separated.

[Pending — counsel]

Data protection in transit and at rest

Encryption posture as actually configured.

[Pending — counsel]

Proof and tamper evidence

Seed commitment and result hashing, once the live pipeline ships.

[Pending — counsel]

Logging and monitoring

Audit trail retention and alerting.

[Pending — counsel]

Incident response

Escalation path, customer notification, and timelines.

[Pending — counsel]

Sub-processors

Vendors with access, and change notification.

[Pending — counsel]

Compliance

Only frameworks CALCAR can evidence — none asserted here.

[Pending — counsel]

Report a vulnerability

Report suspected vulnerabilities privately and give us reasonable time to remediate before any public disclosure. Do not access, modify, or exfiltrate data belonging to others while testing.

Security contact address[Pending — entity details]

Disclosure response window[Pending — entity details]

Public key / encrypted channel[Pending — entity details]