What we secure — and what we do not pretend to.

This notice describes the security baseline AdaptixCore (operated by FusionEMS Quantum LLC) maintains across the four critical systems currently in scope: Amazon Web Services for infrastructure, GitHub for source control, Plaid for bank linking, and Stripe for customer billing. It does not describe every control in place; it describes the controls that are verifiable and that we are willing to publicly assert.

Workspace-level controls (tenant isolation, RBAC enforcement, audit logging) are governed by each agency's signed Business Associate Agreement.

All public endpoints serve traffic over HTTPS with TLS 1.2 or higher. HSTS is enforced on adaptixcore.com. Traffic to Plaid and Stripe APIs is server-to-server only; no third-party financial provider secret reaches a browser at any point.

Plaid client IDs, Plaid secrets, Stripe restricted keys, and any AWS access credentials are stored in AWS Secrets Manager or injected through the deployment pipeline as masked variables. They are never committed to source control. GitHub secret scanning and dependency scanning run on every code change.

Branch protection is enabled on every production repository. Production releases require a passing CI run and reviewed pull request.

Every privileged action — bank link, bank disconnect, Plaid configuration change, Stripe configuration change, founder console action — writes a record into an append-only audit log. Each record references the hash of the prior record, so any tampering with the chain is detectable.

AI agents on the platform are blocked from moving money, changing bank accounts, deleting financial records, or modifying Plaid / Stripe configuration without an explicit founder confirmation captured in the chain.

Bank accounts are connected only through Plaid Link. The user's explicit consent is captured before any Plaid token is exchanged or stored. Authenticated users can disconnect a linked bank account and request deletion of associated data through endpoints exposed in the workspace.

AdaptixCore does not currently hold SOC 2 Type I or Type II certification. No third-party penetration test has been performed. No 24/7 security operations centre is in place. Plaid production access is gated by the readiness controls listed in the founder console and is enabled per-tenant after review.

AdaptixCore will not publish a certification badge it has not earned, will not represent un-audited controls as audited, and will not list trust seals that have not been validated.

Suspected security issues should be reported to security@adaptixcore.com. We acknowledge security reports within one business day.

For urgent breach notification matters covered by a signed BAA, follow the contact and timeline specified in the executed BAA.