CONTROLS IN PLACE TODAY
How MarkSentry protects your account and evidence.
Here is what is in place today, what data each service receives, and what is not certified yet.
IMPLEMENTED CONTROL REGISTER
Email magic links only. There are no passwords to store, leak, or reuse. Links expire in 15 minutes and are single-purpose.
Amazon DynamoDB on AWS, encrypted at rest with DynamoDB's default server-side encryption.
Stripe Checkout and the Stripe billing portal. Card numbers never touch MarkSentry's servers.
Google Analytics on the public pages only: page views, no advertising or session-replay scripts. Not started on sign-in, account, report, checkout, or dashboard pages, and cookieless for visitors in the EEA, the UK, and Switzerland (see the Cookie Policy).
SERVICE BOUNDARY
Who handles what
HONEST CONTROL REGISTER
Not in place yet
- SOC 2 or ISO 27001 certification
- A third-party penetration test
- A bug bounty program
- Multi-factor authentication beyond the magic link
- A published status page for the ingest pipeline
When any of these lands, this page changes the same day and the changelog says so.
SECURITY DETAILRead every implemented control
In place
- Sign-in
- Email magic links only. There are no passwords to store, leak, or reuse. Links expire in 15 minutes and are single-purpose.
- Session
- One first-party cookie (marksentry_session), HttpOnly, Secure, SameSite=Lax, 30 days, set only when you click the link's confirm button.
- Payments
- Stripe Checkout and the Stripe billing portal. Card numbers never touch MarkSentry's servers.
- Data at rest
- Amazon DynamoDB on AWS, encrypted at rest with DynamoDB's default server-side encryption.
- Data in transit
- HTTPS everywhere; the site and API are served only over TLS.
- Secrets
- API keys live in AWS Systems Manager Parameter Store (encrypted) and the hosting platform's environment configuration, never in the code repository.
- Least privilege
- The web tier uses scoped MarkSentry table and email permissions. Evidence storage, when enabled, is limited to its dedicated private bucket. The ingest functions run under their own scoped roles.
- Scan reports
- Report links are unguessable identifiers, are not indexed, and expire after 30 days.
- AI triage
- Runs on Anthropic's Claude API. What is sent is the comparison itself: the text of your mark and its classes (or, for a design, the image you registered) alongside the candidate filing. Nothing else about your account.
- Trackers
- Google Analytics on the public pages only: page views, no advertising or session-replay scripts. Not started on sign-in, account, report, checkout, or dashboard pages, and cookieless for visitors in the EEA, the UK, and Switzerland (see the Cookie Policy).
- Reporting a vulnerability
- Email security@marksentry.ai. We read it; we will acknowledge within a few days and say what we did.