Policy Overview
At Aevum Encyclopedia, supply chain security is not an afterthought—it is foundational to our mission of delivering verified, unbiased, and resilient knowledge. Because we operate at the intersection of AI, open data, and academic publishing, we treat every dependency, data source, and vendor relationship as a potential trust boundary.
This document outlines our security controls, governance processes, and transparency commitments regarding the software, data, and service supply chains that power our platform.
Core Principle: Verifiable Provenance
Every component entering our ecosystem—from open-source libraries to AI training datasets—must carry verifiable provenance, undergo automated and manual review, and maintain an immutable audit trail.
Software & Data Supply Chain Controls
Our infrastructure relies on a blend of proprietary systems, open-source dependencies, and external data feeds. We enforce strict controls at every integration point.
SBOM & Dependency Management
We maintain up-to-date Software Bill of Materials (SBOM) for all production services using SPDX 2.3 and CycloneDX formats. Dependencies are pinned, hashed, and scanned via Snyk and Trivy before merging.
Secure CI/CD Pipelines
All deployments follow zero-trust principles. Build agents run in ephemeral, air-gapped environments. Artifacts are signed with Sigstore/cosign and verified before promotion.
Data Pipeline Integrity
Ingested datasets are validated against schema contracts, checksummed, and processed through deterministic transformation steps. Lineage tracking is maintained via OpenLineage.
Open-Source Governance
We adhere to the Linux Foundation Open Source Supply Chain Security guidelines. All OSS contributions are reviewed against DFSG compatibility, license compliance, and vulnerability exposure.
AI/ML Model & Training Data Security
As an AI-enhanced encyclopedia, model provenance and training data integrity are critical supply chain concerns. We implement the following controls:
- Model Attestation: All LLMs and fine-tuned variants are registered with model cards, training metadata, and cryptographic hashes.
- Dataset Provenance: Training corpora are sourced from licensed, public-domain, or contributor-verified repositories. Sources are cataloged with DOI/Wikidata identifiers where applicable.
- Poisoning & Drift Monitoring: Continuous evaluation pipelines detect distribution shifts, prompt injection patterns, and data contamination using statistical and semantic baselines.
- Human-in-the-Loop Validation: High-confidence AI outputs are cross-referenced against peer-reviewed sources before publication or recommendation.
Third-Party & Vendor Risk Management
We categorize vendors by data sensitivity and criticality. Our vendor risk program includes:
| Vendor Tier | Assessment Frequency | Security Requirements | Examples |
|---|---|---|---|
| Tier 1 (Critical) | Quarterly | SOC 2 Type II, ISO 27001, DPA, penetration test results | Cloud providers, core AI infrastructure |
| Tier 2 (Standard) | Annually | SOC 2 Type I or equivalent, vulnerability disclosure policy | CDN, monitoring, backup services |
| Tier 3 (Low Risk) | Onboarding + Spot checks | Acceptable use agreement, basic security questionnaire | Analytics, marketing, non-critical APIs |
All third-party contracts include right-to-audit clauses, breach notification requirements within 24 hours, and data residency restrictions where mandated by regulation.
Compliance & Certifications
Aevum Encyclopedia maintains compliance with globally recognized security and privacy frameworks:
- SOC 2 Type II — Audited annually by independent CPA firms
- ISO/IEC 27001:2022 — Certified Information Security Management System
- NIST SSDF (SP 800-218) — Secure Software Development Framework alignment
- EU AI Act Readiness — Risk classification, transparency logging, human oversight protocols
- GDPR / CCPA / LGPD — Data minimization, consent management, DSR automation
Transparency Reports
We publish quarterly transparency reports covering data requests, incident summaries, model updates, and third-party audit outcomes. Access the latest report here.
Incident Response & Responsible Disclosure
Supply chain vulnerabilities are treated as P1 incidents. Our response workflow includes:
- Automated dependency alerting via GitHub Advisory Database, OSV, and internal scanners
- 72-hour triage window for severity assessment and containment
- Coordinated disclosure with affected maintainers and CVE assignment when applicable
- Post-incident retrospectives published with actionable remediation timelines
If you believe you've discovered a supply chain vulnerability affecting Aevum Encyclopedia, please report it responsibly:
📧 security@aevum.org
🔑 PGP Key: 4A9F 8B2E 1C0D 7E5A 9F3B 2D8C 6E1A 4B0F 8D9C 2A7E
📄 security.txt endpoint available at root
Version History & Attestation
This policy is version-controlled and cryptographically signed. Changes are reviewed by our Security Engineering, Legal, and Trust & Safety teams.
| Version | Date | Summary | Status |
|---|---|---|---|
| 2.4.1 | 2025-10-12 | Added AI Act compliance mapping, updated vendor tier thresholds | Current |
| 2.3.0 | 2025-06-08 | Introduced model attestation standards, expanded SBOM coverage | Archived |
| 2.1.0 | 2025-01-22 | Initial publication aligned with NIST SSDF & OpenSSF Scorecard | Archived |