Trust Center
TUCE AI — Trident Unified Cognitive Engine
Public security, privacy, and compliance posture · 2026-09-15. Status: operational.
Status
operational
Annex A controls
93
Durable backend
Filesystem
Claim register
Named claims. Named refuses. No invented seal.
If it is not HAVE, it is labelled. Analogue is not native. Aligning is not a letter. C4 Recur cannot self-promote.
| Claim | Status | Never |
|---|---|---|
| Kernel 8.4.9 atlas-join | HAVE | Website stamp is not a kernel bump. |
| Website 8.4.19 prism-live | HAVE | Packaging stays off Home H1. |
| UAOP 8.4.6 | HAVE | Hormone bands are not a medical device. |
| Compounding 8.4.3 | HAVE | Not a public SLA letter. |
| Promote is F08 after Hold | HAVE | Hold is not Promote. skipHitl cannot open Hold. |
| C4 Recur | PLAYBOOK | exploration_not_shipped. Cannot self-promote. |
| Isolation Score | ANALOGUE | Local canary. Not an air gap. |
| HMAC ACK | ANALOGUE | HMAC ACK is not A2A conformance. |
| Partner checkout (VEMO / EngOS / MSP) | PARTNER | The tower does not cart. Command, not merge. |
| SOC 2 Type II | Not a letter | Aligning work. No seal on Home. |
| ISO 27001 / HIPAA / WCAG AAA | Not a letter | Engines and goals, not certificates. |
| PWA Add to Home Screen | HAVE | Not an App Store SKU. This browser, not a conversion rate. |
| First-party in-tab ledger | HAVE | Never leaves this origin. Not GA4. |
| WebGPU detect + WebGL2 fallback | HAVE | This-browser, not field telemetry. Never a Vision Pro badge. |
| PWA offline Method + llms.txt | HAVE | Not a whole-origin cache. Not a store binary. |
Certifications & roadmaps
In progress is not a letter. We do not display seals we do not hold.
- SOC 2 Type IIin_progress
Observation window automation live; report pending auditor fieldwork
- ISO/IEC 27001:2022aligning
Full Annex A (93 controls) SoA available to customers under NDA
- GDPR / ISO 27701 PIMScontrols_mapped
PIMS overlay on privacy Annex A
Data Processing Agreement
DPA 2026.1 is available for enterprise customers. Contact privacy@tuce.ai.
Subprocessors
Full table on /subprocessors.
SOC 2 Type II timeline
- Readiness & gap remediationT0–T4 (weeks 0–4)
- Auditor selection & kickoffT4–T8 (weeks 4–8)
- Type I (optional) / design validationT8–T12 (optional)
- Type II observation window3–12 months continuous
- Fieldwork & sample testing+4–6 weeks after observation end
- Draft → final Type II report+2–4 weeks
Security: security@tuce.ai · Privacy: privacy@tuce.ai
Evidence packs, dual-control, and signed audit of policy / promotion / tool decisions are the sendable trust language. Aligning, not certified. SSO + directory sync + group→role + revoke on deprovision is the enterprise identity path — not a vendor homepage, and not claimed live on every family origin.