Skip to main content

sigmashake-docs — Customer Security Whitepaper

Customer-facing summary of how the SigmaShake documentation site (docs.sigmashake.com) is built and hosted. Written for a security or compliance reviewer at a customer evaluating SigmaShake as part of their AI-governance stack.

What sigmashake-docs is​

sigmashake-docs is the public documentation site of the SigmaShake platform. It is a static site. Docusaurus builds it into plain HTML, JavaScript and CSS files, and Cloudflare Pages serves those files.

The site has no accounts, no sign-in, no sessions, and no database. It does not store customer data. It has no audit log of its own. A reader does not need to sign in to read any page.

For services that do hold customer data (the governance dashboard, the fleet control plane, the hub, and accounts), see the Data Processing Agreement and the Privacy Policy. Those pages list the sub-processors, the data categories, and the retention rules for those services.

Architecture summary​

  • Docusaurus builds the site into static files (build/).
  • Cloudflare Pages serves the static files from Cloudflare's edge network.
  • The site has no runtime Worker, no D1 database, no KV namespace, no R2 bucket, and no Secrets Store binding (see wrangler.toml).
  • Search is a client-side index that the build creates. The search does not call an external service. Page fonts are loaded from Google Fonts (see "Data we hold about you").
  • TLS: this site (docs.sigmashake.com, Cloudflare Pages) accepts TLS 1.2 and TLS 1.3. The SigmaShake Worker hostnames accept TLS 1.3 only. Measured 2026-10-11.

For deeper architectural detail, the architecture decision records (ADRs) are repository files in docs/adr/. They are not published, and they are available on request at [email protected].

Data we hold about you​

The docs site itself holds no customer data and sets no cookie for sign-in. Every page loads a font stylesheet from Google Fonts, so Google receives each reader's IP address, user agent and referrer. Google is on the sub-processor list with its DPA and transfer assessment still pending.

DataPurposeRetentionLocation
Edge request logs and aggregate traffic metrics (Cloudflare)Delivery and service healthSet by CloudflareCloudflare
Visitor IP address, user agent and referrer, sent to Google when a page loads fonts from fonts.googleapis.comDelivery of page fontsSet by GoogleGoogle (sub-processor; DPA and transfer assessment pending)

For analytics on SigmaShake web properties, see the Cookie Policy.

Encryption​

  • In transit. This site (docs.sigmashake.com, Cloudflare Pages) accepts TLS 1.2 and TLS 1.3. The Cloudflare edge accepts TLS 1.3 only on the Worker hostnames (sigmashake.com, trust, security, compliance, accounts, hub and download) and rejects TLS 1.2 and older there. Measured 2026-10-11.
  • At rest. The site stores only public documentation files. See Encryption at rest.

Access controls​

  • Publishing the site needs a deploy from the repository. With SSG_DEPLOY_STRICT=1, the deploy script requires a working tree that matches origin/main.
  • The site has no operator accounts, no roles, and no per-action audit events.

Incident response​

  • Security reports go to [email protected]. The acknowledgement time and the patch targets are in the CVE response targets.
  • Vulnerability reports are acknowledged within 72 hours (target).
  • Remediation targets: Critical 72 hours, High 7 days, Medium 30 days, Low next planned release. These are targets, not guarantees.
  • Customer notice: for a Sev-1 incident that exposes customer data, affected customers receive an email from [email protected] within 72 hours of confirmation. Where you are the controller and SigmaShake is the processor of a Personal Data breach, the target is without undue delay, within 36 hours of confirmed awareness. This is a target, not a guarantee. See the breach notification procedure (docs/compliance/breach-notification-procedure.md section 7.1).

Compliance posture​

  • SOC 2: self-assessed. No CPA firm is engaged, and no SOC 2 report or certificate exists. The observation window runs 2026-05-18 to 2026-11-17. A Type II report is not possible before Q1 2027.
  • ISO/IEC 27001:2022: self-assessed alignment. SigmaShake holds no ISO 27001 certification.
  • GDPR / CCPA data-subject requests: see the DSAR runbook.

Contact​

  • Security issues: [email protected]
  • Support: sigmashake.com/support
  • Self-assessment evidence: trust.sigmashake.com