Security & Compliance
How the NEORM-ERA website and our client engagements handle your data, stated plainly.
Last reviewed 26 September 2026. Every statement on this page describes what the service does today. Where something is not in place, we say so.
At a glance
| Operator | TAURUS AI Corp., a federal Canadian corporation (CBCA 1702855-5), Windsor, Ontario |
|---|---|
| Hosting | Cloudflare Pages and Workers (global edge network) |
| Transport | HTTPS only, TLS 1.2 and 1.3, HSTS with preload |
| Customer accounts | None on this website. Engagements are delivered by our team, not through a self-serve login. |
| Card data | Never reaches our servers. Payments are taken in our processor's hosted checkout (Stripe or Sokin). |
| Certifications | We do not currently hold SOC 2 or ISO 27001. We complete security questionnaires for enterprise buyers. |
| Security contact | [email protected] · security.txt |
What the website handles
Contact and audit requests are checked server-side (field validation, a hidden bot field and Cloudflare Turnstile) and sent to our team by email. They are not written to a database.
Briefs typed into the live studio are processed to produce the response and are not stored by the website. When an AI step runs, the brief is sent to the model provider listed under subprocessors for that request only.
Email addresses you give the studio are sent to our team so we can follow up. The country of the request comes from Cloudflare; your IP address is not sent to any lookup service.
Browser protections
Every page is served with Strict-Transport-Security (two years, preload), X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, a strict referrer policy, and a Permissions-Policy that disables camera, microphone and geolocation.
Build tooling, tests and server-side source are kept out of the published site by the deploy process, and an automated check blocks a release that would publish them.
Tracking
Site analytics use Cloudflare Web Analytics, which sets no cookies. Advertising cookies (Meta, Google Ads) exist only on our campaign pages and load only if you choose Accept.
Enterprise engagements
For client work we agree data handling in writing before we start: which systems we access, where outputs are stored, and who on our team can see them. Ask us for our security questionnaire responses or a data processing agreement.
Reporting a vulnerability
Email [email protected] with "Security report" in the subject. We aim to acknowledge reports within two business days. Please give us reasonable time to fix an issue before disclosing it, and do not access other people's data or disrupt the service while testing.