Maelstrom AI Transparency Report

Our Commitment to Transparency

Transparency is a core value for Maelstrom AI. While most age verification and backup vendors treat their security practices as trade secrets, we believe that privacy and security are strengthened by openness, not obscured by secrecy.

Maelstrom AI operates two platforms under one ISMS: Provii (zero-knowledge age verification) and downpipes (no-custody backup & disaster recovery for the Cloudflare data layer). This report covers both. Where a practice applies to one platform only, we say so; where it applies organisation-wide, it applies to both.

Why Transparency Matters

Traditional age verification systems ask users to trust privacy policies and corporate promises. The Provii platform offers something better: independently verifiable privacy properties through:

• Open source code - Anyone can audit our cryptographic implementation
• Public ISMS - Complete security documentation available for review
• Published architecture - Data flows and privacy protections fully documented
• Zero knowledge proofs - Mathematical design that makes PII collection architecturally unnecessary

The same philosophy applies to downpipes: the no-custody architecture means Maelstrom holds no customer keys, data or Cloudflare tokens at any time, the engine and console run in the customer’s own Cloudflare account, under the customer’s keys, the offline reader is open source, and the archive format is a frozen public spec — so the recoverability guarantee is independently verifiable rather than a promise.

Bottom Line: We don’t ask you to trust our privacy promises. We enable you to verify them.

What We Make Public

1. Open and Source-Available Code

Status: ✅ Open source (Provii core + downpipes offline reader); source-available (downpipes engine/console/control-plane)

Provii repositories (open source):

• provii-crypto. Cryptographic primitives (Groth16 ZK-SNARKs, Pedersen commitments, RedJubjub signatures)
• provii-agegate. Browser SDK for website integration
• agegate-rust. Core verification and issuance services
• Provii mobile wallet (client) repository under the MaelstromAI GitHub enterprise. Reference mobile wallet implementation
• Demo applications. Complete end-to-end examples

downpipes components (source-available, except the offline reader which is open source):

• engine. Routeless in-tenant Cloudflare Worker — reads sources, seals archives with post-quantum hybrid encryption, 3-2-1 fan-out to customer-controlled destinations
• console. Operator SPA + Worker proxy for configuration, restore approvals, posture and reports
• control-plane. Vendor-operated service that mints licence tokens and receives a content-free advisory beacon (fail-open; holds no customer keys, data or Cloudflare tokens)
• downpipe (offline reader). Restores from archive bytes plus the customer’s offline key alone — no vendor, no network; built from a frozen public format spec

Why: Publishing the source enables independent security review and builds trust through transparency. The Provii zero knowledge architecture has no trade secrets that need protection through obscurity. For downpipes, source-availability lets customers verify exactly what the engine does inside their own tenant, and the open-source offline reader plus frozen format spec mean archives can be recovered without any dependence on Maelstrom.

Where: GitHub (public repositories)

Licence:

• Provii core: per-repo mix of AGPL-3.0-only, Apache-2.0 and MIT (crates dual-licensed MIT OR Apache-2.0), with some proprietary components
• downpipes engine / console / control-plane: Elastic License v2 (source-available — not open source). Free to self-host and to back up and restore; may not be resold as a managed service, because a third party running it would take custody and defeat the no-custody model
• downpipes offline reader: MIT (open source)

2. Information Security Management System (ISMS)

Status: ✅ Publicly published

Location: maelstrom.au/trust (GitHub: docs/iso27001-isms branch)

Coverage:

• A single ISMS spanning both platforms — Provii and downpipes
• All ISO 27001:2022 policies (93 Annex A controls, 95%+ implemented)
• Complete risk register with documented mitigations (including the downpipes control-plane/update-channel and no-custody key-loss risks)
• Statement of Applicability showing control implementation status
• Security controls mapped to ISO 27001, ISO 27701, NIST 800-63
• Privacy controls aligned with GDPR, CCPA, Privacy by Design

Why: Publishing our ISMS demonstrates that we practise what we preach. Other companies claim to have security policies. We show ours.

Unique Achievement: Most companies treat ISMS as confidential. Maelstrom AI publishes everything because the Provii zero knowledge architecture has nothing to hide and the downpipes no-custody architecture holds no customer keys or data to protect through obscurity.

3. Architecture Documentation

Status: ✅ Publicly published

What:

• System Architecture. Component interactions, service boundaries, trust model — for Provii (four-party model: Issuing Party, Wallet, Provii, Relying Party) and for downpipes (in-tenant engine + console, vendor control-plane, signature-pinned update channel)
• Data Flows. Complete documentation of what data goes where (and what doesn’t)
• Trust Model. Which parties learn what information (spoiler: very little)
• Cryptographic Specifications. Groth16 circuits, commitment schemes, signature algorithms (Provii); post-quantum hybrid archive sealing and the frozen public archive format spec (downpipes)
• Privacy Guarantees. Cryptographic design documentation of what the system is designed not to reveal, and — for downpipes — the no-custody operating-model boundary that keeps customer keys and data out of Maelstrom’s hands

Why: Users should understand how their data is (or isn’t) processed. Transparency enables informed consent.

Notable: Zero knowledge proof circuits are fully documented, showing exactly what is proven (age >= threshold) and what remains private (actual date of birth). For downpipes, the operating-model boundary is documented explicitly: Maelstrom builds and maintains the software and operates the vendor-side control-plane, update channel and release pipeline, while the engine and console run in the customer’s own Cloudflare account, under the customer’s keys (customer-operated — complementary user-entity controls).

4. Compliance Documentation

Status: ✅ Publicly published

What We Publish:

• ISO 27001 Alignment. 95%+ implementation of all 93 controls
• ISO 27701 Mapping. Privacy extension controls for PII management
• Privacy by Design Assessment. Evaluation against all 7 foundational principles (5/7 EXEMPLARY, 7/7 IMPLEMENTED)
• GDPR Alignment Statement. Article-by-article alignment with EU privacy regulation (self-assessed)
• CCPA Alignment Statement. California privacy rights implementation (self-assessed)
• NIST 800-63 Alignment. Digital identity assurance levels (IAL2-IAL3, AAL2-AAL3, FAL2-FAL3)
• Unified Control Matrix. Single source mapping requirements across all standards
• Evidence Repository. proof of control implementation

Why: We don’t just claim compliance. We demonstrate it with verifiable evidence.

Maelstrom AI publishes complete compliance documentation alongside ISMS policies and architecture details.

What We Collect (and Don’t Collect)

The data described below relates to the Provii age-verification platform. downpipes is no-custody: it runs in the customer’s own Cloudflare account under the customer’s own keys, and Maelstrom holds no customer keys, data or Cloudflare tokens. The only downpipes signal Maelstrom receives is a content-free advisory beacon to the vendor control-plane (no customer data). Consequently downpipes adds no end-user PII, identity data or backup contents to the categories below.

Data We Collect (Provii)

Total Categories of Personal Information: 1 out of 11 CCPA categories (Internet/Network Activity)

Reference: Data Retention Policy (/trust/security/data-retention.mdx)

Data We Do NOT Collect

The following data is architecturally designed not to be collected by Maelstrom AI-operated services:

NOT COLLECTED (By Zero-Knowledge Design):

Personal Identifiers:
❌ Names (first, middle, last)
❌ Email addresses
❌ Phone numbers
❌ Physical addresses (home, work, mailing)
❌ Usernames or account identifiers

Age/Identity Data:
❌ Dates of birth (processed ephemerally server-side during issuance: Pedersen commitment computed, raw DOB discarded immediately, never persisted; not collected during verification)
❌ Exact age (only binary threshold proven: over/under)
❌ Government-issued ID numbers (driver's licence, passport, SSN)
❌ Identity document scans or photos

Biometric Information:
❌ Facial recognition data
❌ Fingerprints
❌ Voice prints
❌ Retinal scans
❌ Any biometric identifiers

Financial Information:
❌ Credit card numbers
❌ Bank account details
❌ Financial transaction history

Location Information:
❌ Precise geolocation (GPS coordinates)
❌ Home/work addresses
❌ Location history

Online Activity:
❌ Browsing history
❌ Search queries
❌ Cross-site tracking identifiers
❌ Persistent user IDs
❌ Advertising cookies

Other Sensitive Data:
❌ Health information
❌ Sexual orientation
❌ Racial or ethnic origin
❌ Religious beliefs
❌ Political affiliations
❌ Union membership

Why We Don’t Collect: Zero knowledge architecture is designed to make PII collection unnecessary. The Pedersen commitment to date of birth is computed server-side during issuance; the raw DOB is discarded immediately and never persisted. During verification, no PII is transmitted or collected.

Evidence:

• Privacy Architecture Evidence (/trust/compliance/evidence/privacy-controls/privacy-architecture-evidence.md, Lines 37-95)
• Information Security Policy: “Zero knowledge First” principle

Security Practices

Cryptographic Security

Provii — algorithms in production:

• Groth16 ZK-SNARKs. Zero knowledge proof system (BLS12-381 curve)
• Pedersen Commitments. Cryptographically hiding commitments to date of birth
• RedJubjub Signatures. Issuer credential signatures (Jubjub elliptic curve)
• SHA-256 + Blake2s-256 Hashing. SHA-256 for RP challenge binding; Blake2s-256 for RP hash (circuit input) and nullifier
• SHA-256. PKCE code challenge (S256) and IP address pseudonymisation

downpipes — archive sealing:

• Post-quantum hybrid encryption seals every archive under customer-held keys (break-glass, operational and archive-signer keys), so Maelstrom never holds the means to decrypt customer backups
• Keys are customer-generated via a guided in-browser key ceremony, with a printed recovery sheet and offline-storage guidance (encrypted USB, password manager, Shamir split); the default posture is two-recipient, with a strict break-glass-only opt-out
• Vendor-side keys are limited to the downpipes Licence Signer (Cloudflare Secrets Store, control-plane, fail-open) and the downpipes Update Signer (held offline by the operator, never deployed to any Worker) — neither can decrypt customer data

Security Status: Production-ready implementation, pending formal third-party audit

Audit Plans:

• Cryptographic Audit. Will pursue when commercially viable (specialised zero knowledge proof auditing firm)
• Penetration Testing. Q2 2026 (infrastructure and API security)
• Annual Security Audits. Ongoing commitment post-launch

Cryptographic Evidence: implementation documentation available at /trust/compliance/evidence/cryptography/crypto-implementation-evidence.md

Infrastructure Security

Provider: Cloudflare

• Certifications. SOC 2 Type II, ISO 27001, ISO 27701 (supplier-held, via Cloudflare)
• Architecture. Serverless edge computing (Cloudflare Workers)
• Availability. 99.99% SLA (Cloudflare’s own infrastructure SLA; Maelstrom AI does not offer a contractual SLA at this tier)
• DDoS Protection. Enterprise-grade, automatic mitigation
• Geographic Distribution. Global edge network (300+ cities)

Security Controls:

• Encrypted data at rest and in transit (TLS 1.3)
• Automatic TLS certificate management
• Web Application Firewall (WAF)
• Rate limiting and bot protection
• Zero-trust network architecture

downpipes deployment topology: The engine (routeless, in-tenant) and console run in the customer’s own Cloudflare account, under the customer’s keys, with no standing inbound path from Maelstrom (“runs dark”). Maelstrom operates only the vendor-side control-plane (mints licence tokens + a content-free advisory beacon; fail-open — never gates backup or restore) and the static, signature-pinned update channel (updates.downpipes.io): the engine verifies an update’s signature against a pinned public key and pulls updates (never pushed), with canary-gated safe-apply and automatic rollback, and no phone-home. downpipes backs up Workers KV, D1, R2, Secrets Store, and 51 zone/account configuration surfaces.

Evidence: Infrastructure Evidence (/trust/compliance/evidence/infrastructure/infrastructure-evidence.md)

Development Security

Secure Development Practices:

1. Multi-Layered Security Scanning:

• SAST (Static Application Security Testing): Semgrep, CodeQL
• SCA (Software Composition Analysis): Dependabot, cargo-audit
• Secrets Scanning. GitHub secret scanning, TruffleHog
• Runtime Security. Cloudflare Workers sandboxed execution

2. Supply Chain Security:

• SLSA Level 3 alignment: Hermetic builds, provenance tracking
• Dependency Management. Automated updates via Dependabot
• Lock Files. Cargo.lock, package-lock.json for reproducible builds
• Vulnerability Monitoring. Daily scans of all dependencies
• Signed update channel (downpipes). The downpipes engine pulls updates from a static, signature-pinned R2 bucket (updates.downpipes.io) and verifies each update’s signature against a pinned public key before applying; the downpipes Update Signer is held offline by the operator and is never deployed to any Worker. Updates are canary-gated with automatic rollback and never pushed into customer tenants.

3. Code Review:

• Mandatory Review. All changes require review (no self-merge)
• Branch Protection. Main branch protected, CI must pass
• Security Review. Cryptographic changes require specialised review
• Audit Trail. All changes logged in Git history (public on GitHub)

Evidence: DevOps Evidence (/trust/compliance/evidence/development/devops-evidence.md)

Incident Reporting

Security Incident Disclosure

Policy: Public disclosure of security incidents affecting user privacy

2024-2025 Period:

• Security Incidents. 0
• Data Breaches. 0 (no PII to breach)
• Privacy Violations. 0
• Service Outages. 0 (pre-production phase)

Why Zero Breaches: Data that is not collected cannot be breached. The Provii zero knowledge architecture is designed to reduce the PII exposure that makes other age verification companies attractive targets, and the downpipes no-custody architecture means Maelstrom holds no customer keys, data or Cloudflare tokens to breach in the first place.

Reporting: security@maelstrom.au

Disclosure Timeline:

1. Immediate: Critical vulnerabilities affecting user safety
2. 48 hours: High-severity security issues
3. 30 days: Medium/low-severity issues (after patch deployed)

Vulnerability Disclosure

Programme: Responsible disclosure policy via security@maelstrom.au

How to Report:

• Email. security@maelstrom.au
• PGP Key. Available on website (encrypted reporting for sensitive issues)
• Anonymous. Tor-friendly disclosure accepted

Our Commitment:

1. Acknowledgement: Within 48 hours of report
2. Assessment: Severity rating and fix timeline within 5 business days
3. Fix Timeline: Based on severity (critical: 7 days, high: 14 days, medium: 30 days)
4. Public Disclosure: After fix deployed and users protected
5. Credit: Public acknowledgement of reporter (if desired)

Vulnerabilities Reported (2024-2025):

• Pre-production phase: No public vulnerability reports received
• Internal testing: Issues identified and resolved before launch

Vulnerability Reporting:

• Method. Email security@maelstrom.au
• Response. Within 48 hours acknowledgement
• Scope. All Maelstrom AI services and applications across both platforms — Provii and downpipes (including the downpipes engine, console, control-plane, offline reader and update channel)

Compliance Certifications

The certification programme below is run at the organisation level and covers both platforms (Provii and downpipes) under the single Maelstrom AI ISMS.

Current Status

Legend:

• ✅ Complete: Documented and verified
• 🔄 In Progress: Active work underway
• 📋 Planned: Scheduled for future

Audit Schedule

ISMS Documentation Development:

• Q1 2025: ISMS documentation completed (ISO 27001:2022, ISO 27701:2019)

Internal Audits:

• Internal Audit #1: February 2026 (Batch A: ISMS foundation, access control, cryptography)
• Internal Audit #2: February 2026 (Batch B: Privacy controls, data lifecycle, incident response)
• Management Review #1: 15 February 2026
• Future: Quarterly internal audits planned

External Audits: Planned when commercially justified

• Cryptographic security audit. Zero knowledge proof implementation (when commercially viable)
• Penetration testing. Infrastructure and API security
• ISO 27001 certification audit. When commercially justified
• ISO 27701 certification audit. Post-27001, when commercially justified
• Annual surveillance audits. Post-certification

Audit Readiness: 95%+ - ISMS documentation complete, evidence collection

Data Subject Rights

How to Exercise Your Rights

Contact: privacy@maelstrom.au

Response Time: 30 days (may extend to 90 days with notification)

Verification: Email verification or cryptographic challenge-response

Rights Available

1. Right to Access

What: Request what data we hold about you

Our Response: “We hold minimal data about you:”

• IP address (hashed, if within 90-day retention window)
• Verification timestamps (if recent)
• No PII. We do not have your name, date of birth, or identity information

How to Exercise: Email privacy@maelstrom.au with your IP address and approximate verification date

2. Right to Deletion

What: Request deletion of your data

Our Response:

• Automatic Deletion. IP logs auto-deleted after 90 days
• Expedited Deletion. We can delete your IP logs immediately upon request
• Wallet Data. Credentials stored locally on your device. Delete the wallet app to erase

How to Exercise: Email privacy@maelstrom.au with deletion request

3. Right to Correction

What: Request correction of inaccurate data

Our Response:

• IP Addresses. Automatically collected (no inaccuracy possible)
• Date of Birth. Stored in your wallet (update locally, request new credential)
• No PII on Servers. Nothing to correct server-side

How to Exercise: Typically not applicable (minimal server-side data)

4. Right to Portability

What: Export your data in machine-readable format

Our Response:

• Wallet Data. Export credentials from wallet (JSON format)
• Server Data. Minimal (IP logs, timestamps) - can provide in JSON/CSV
• Note. Most data never leaves your device

How to Exercise: Email privacy@maelstrom.au or use wallet export feature

5. Right to Object

What: Object to processing of your data

Our Response:

• IP Logging. Necessary for anti-abuse (legitimate interest)
• You can object. We will assess if processing can stop without compromising service security
• Alternative. Stop using Provii services (no further data processing)

How to Exercise: Email privacy@maelstrom.au with objection details

2024-2025 Period

Data Subject Access Requests:

• Access requests: 0 (pre-production phase)
• Deletion requests: 0
• Correction requests: 0
• Portability requests: 0
• Objection requests: 0

Average Response Time: N/A (no requests received)

Note: Pre-production phase with limited user base. Metrics will be reported post-launch.

Third-Party Disclosures

Service Providers

downpipes and sub-processors: Because downpipes is no-custody — the engine and console run in the customer’s own Cloudflare account, under the customer’s own keys, and Maelstrom holds no customer keys, data or Cloudflare tokens — Maelstrom introduces no sub-processor for customer data when a customer runs downpipes. The customer’s own Cloudflare account (the customer’s existing relationship with Cloudflare) holds the sources and the customer-controlled backup destinations; Maelstrom’s vendor-side control-plane and update channel receive only licence tokens and a content-free advisory beacon, never customer data.

Contractual Protections:

• Data Processing Agreements (DPA). In place with Cloudflare
• Standard Contractual Clauses (SCC). For international data transfers
• GDPR Compliance. All processors meet EU privacy requirements
• Audit Rights. Ability to audit subprocessor compliance

Evidence: Vendor Evidence (/trust/compliance/evidence/vendors/third-party-evidence.md)

We Do NOT Share Data With

The following third parties receive no data from Maelstrom AI:

NO DATA SHARED WITH:
❌ Advertisers (no advertising integrations)
❌ Data brokers (no data monetisation)
❌ Marketing companies (no marketing analytics)
❌ Third-party analytics (operational telemetry only, via Cloudflare Workers Logs shipped to Grafana Loki - aggregated, privacy-preserving)
❌ Social media platforms (no tracking pixels)
❌ Affiliate networks (no performance tracking of users)
❌ Credit bureaus (no identity verification partnerships)
❌ Background check services (no identity proofing)

Business Model: Websites pay per verification, issuers receive royalties. No data monetisation required.

Cross-Border Data Transfers

Data Storage Locations:

• Cloudflare Global Network. Data processed at edge locations worldwide
• Primary Regions. EU, US, Asia-Pacific (auto-routed to nearest edge)
• Data Residency. Configurable per deployment (EU-only option available)

Legal Mechanisms:

• Standard Contractual Clauses (SCC). EU Commission-approved clauses for international transfers
• GDPR Article 49. Necessary for service delivery
• Minimal Risk. No PII transferred (only IP addresses and cryptographic proofs)

Evidence: Privacy Architecture Evidence (Cross-Border Transfer section)

Law Enforcement Requests

2024-2025 Period

Requests Received: 0

Data Provided: 0

Reasons:

• Pre-production phase (limited user base)
• No PII stored (nothing meaningful to provide)
• Age verification data not typically subject to legal requests

Our Policy

Legal Process Required:

• Valid court order, subpoena, or warrant
• Jurisdiction verification
• Narrow scope (specific users, time periods)
• Legal review before compliance

What We Can Provide:

• IP addresses (if within 90-day retention window)
• Verification timestamps
• Challenge records (if recent)
• Cannot Provide. Names, addresses, dates of birth (not collected)

User Notification:

• Notify affected users when legally permitted
• Sealed court orders: Notify after seal lifted
• National security letters: Transparency to extent allowed by law

Transparency Commitment:

• Publish aggregate statistics annually
• Disclose types of requests (civil, criminal, national security)
• Report number of users affected

Principles

1. Minimise Disclosure: Provide only what is legally required
2. Challenge Overbroad Requests: Push back on fishing expeditions
3. User Rights First: Protect user privacy to fullest extent of law
4. Transparency: Disclose requests unless legally prohibited

Changes to Privacy Practices

2024-2025 Period

Material Changes: None

Minor Updates:

• Privacy by Design assessment completed (2025-11-08)
• CCPA compliance statement finalised (2025-11-08)
• NIST 800-63 alignment documented (2025-11-08)
• Transparency report published (2025-11-08)

Change Management Policy

Material Changes (require user notification):

• New categories of PII collected
• Changes to data retention periods (beyond 90 days)
• New third-party data sharing arrangements
• Changes to cryptographic protocols affecting privacy

Notification Process:

1. 30-day advance notice before implementation
2. Email notification to users (if email addresses collected - currently N/A)
3. Prominent website notice on privacy policy page
4. Changelog published in transparency report

User Rights:

• Opt-out. Users can delete wallets and stop using service before changes take effect
• Continued Use. Constitutes acceptance of updated practices
• Grandfathering. Existing credentials not retroactively affected

Immaterial Changes (no notification required):

• Clarifications to privacy policy language
• Organisational changes (address, contact info)
• Enhanced privacy protections
• Bug fixes

Change Log

Independent Verification

How to Verify Our Claims

Maelstrom AI’s transparency enables independent verification of all privacy and security claims:

1. Review Source Code (GitHub)

What to Check:

• Cryptographic implementation (zero knowledge proofs)
• Data flows (confirm no PII transmission)
• Logging practices (IP hashing, data minimisation)
• API endpoints (verify what data is collected)

Where: GitHub repositories (public)

Tools:

• Static Analysis. Semgrep, CodeQL (same tools we use)
• Manual Review. Read the code directly
• Security Researchers. Engage experts to audit

2. Review ISMS Documentation

What to Check:

• Security policies (alignment with best practices)
• Risk register (identified threats and mitigations)
• Control implementation (evidence of security controls)
• Compliance documentation (GDPR, CCPA, ISO 27001)

Where: /trust/ (GitHub branch: docs/iso27001-isms)

Published At: maelstrom.au/trust

3. Cryptographic Verification

What to Check:

• Zero knowledge proof circuits (confirm privacy properties)
• Cryptographic protocols (verify soundness)
• Key management (validate secure practices)

Audit: Will pursue third-party cryptographic audit when commercially viable

Current Status: Production-ready implementation, documentation available

4. Infrastructure Verification

What to Check:

• Cloudflare Certifications. SOC 2, ISO 27001 publicly available
• Network Inspection. Use browser dev tools to see what data is transmitted
• TLS Verification. Confirm encrypted connections (TLS 1.3)

Evidence: Published Cloudflare compliance reports

Community Security Reviews

Encouraged Activities:

• Code Audits. Review cryptographic implementation
• Privacy Analysis. Verify zero knowledge claims
• Security Testing. Test for vulnerabilities (responsibly disclosed)
• Documentation Review. Check for inconsistencies or gaps

How to Contribute:

• GitHub Issues. Report findings publicly (for non-sensitive issues)
• Security Email. security@maelstrom.au (for vulnerabilities)
• Pull Requests. Suggest improvements to documentation or code

Recognition:

• Public acknowledgement in security advisories (if desired)
• Acknowledgment in security advisories
• Listed in transparency report contributors section

Vulnerability Disclosure Programme

Responsible Disclosure

Maelstrom AI operates a responsible disclosure programme. Security researchers are encouraged to report vulnerabilities via security@maelstrom.au.

Safe Harbour: Researchers who comply with responsible disclosure practices are protected from legal action for good faith security research. We will not pursue legal action against researchers who responsibly disclose vulnerabilities.

Contact Information

General Inquiries

Email: contact@maelstrom.au Website: maelstrom.au Documentation: maelstrom.au/trust

Security Issues

Email: security@maelstrom.au PGP Key: Available on website for encrypted communication Response Time: 48 hours acknowledgement

Privacy Requests

Email: privacy@maelstrom.au Data Subject Rights: Access, deletion, correction, portability Response Time: 30 days (may extend to 90 days with notice)

Data Protection Officer (DPO)

Status: To be appointed (required when GDPR processing reaches threshold) Current: Privacy Officer handles privacy matters Contact: privacy@maelstrom.au

Compliance Questions

Email: contact@maelstrom.au Topics: Certifications, audit requests, regulatory questions

Future Transparency Initiatives

Planned Enhancements

1. Real-Time Transparency Dashboard

Timeline: Q2 2026

Metrics to Display:

• Verifications performed (aggregated, no user data)
• Service uptime and availability
• Average response times
• Security incidents (if any)
• Law enforcement requests (aggregated)
• Data subject access requests received/resolved

Why: Proactive transparency builds trust

2. Quarterly Transparency Reports

Timeline: Ongoing (starting Q1 2026)

Content:

• Security metrics (incidents, vulnerabilities)
• Privacy metrics (requests, complaints)
• Service metrics (uptime, performance)
• Compliance updates (certifications, audits)
• Legal requests (aggregated statistics)

Format: Published blog posts + machine-readable JSON

3. Public Audit Reports

Timeline: As audits completed (starting Q2 2026)

What We’ll Publish:

• Penetration test executive summaries
• Certification status updates

Why: Third-party validation of our security claims

4. Community Security Reviews

Timeline: Q2 2026 (post-launch)

Initiatives:

• Responsible disclosure. security@maelstrom.au
• Community audits. Facilitate independent security reviews
• Documentation contributions. Welcome improvements via GitHub

Why: Many eyes make security and privacy stronger

5. Privacy-Preserving Analytics

Timeline: Q2 2026

Commitment:

• No user-level tracking or analytics
• Only aggregate, anonymised metrics
• Cloudflare Workers Logs (shipped to Grafana Loki, privacy-preserving)
• No third-party analytics providers

Published Metrics:

• Total verifications performed
• Geographic distribution (country-level only)
• Issuer adoption metrics
• Verifier integration statistics

Conclusion

Transparency as a Core Principle

Most age verification and backup vendors treat transparency as a risk. Maelstrom AI treats it as a foundational commitment across both platforms:

Traditional Approach:

• “Trust us” - Closed source, confidential security practices
• Privacy policies full of legalese and caveats
• Security through obscurity
• Compliance as checkbox exercise

Our Approach:

• “Verify us” - Open source, public ISMS, documented architecture
• Privacy properties backed by cryptographic design (zero knowledge proofs)
• Security through transparency and peer review
• Compliance as demonstration of values

What Sets Us Apart

1. Open and source-available: Code, documentation and compliance materials are public (Provii core and the downpipes offline reader are open source; the downpipes engine, console and control-plane are source-available under Elastic License v2)
2. Privacy and recoverability by architecture: Privacy is enforced by cryptographic design, not policy alone (Provii’s zero knowledge proofs); recoverability is enforced by no-custody design — customer-held keys, an open-source offline reader and a frozen public archive format (downpipes)
3. Radical Transparency: Security practices openly documented and reviewable
4. Independent Verification: Anyone can audit our claims
5. Community Engagement: Bug bounties, security reviews, public discussions

Our Invitation

We invite security researchers, privacy advocates, and users to:

• Review our code on GitHub
• Audit our architecture using published documentation
• Test our claims through independent verification
• Report vulnerabilities through responsible disclosure
• Hold us accountable to our transparency commitments

Vision

Maelstrom AI aims to set a new standard for transparency across both privacy-preserving age verification and data resilience, demonstrating that privacy, security, recoverability and openness are complementary, not competing objectives.

Goal: Establish the Provii platform as a transparent, independently verifiable age verification system, and downpipes as a transparent, independently verifiable no-custody backup and disaster-recovery platform.

Appendix: Transparency Metrics

2024-2025 Transparency Scorecard

Legend:

• ✅ Achieved
• 🔄 In Progress
• 📋 Planned

What We Measure

Security Transparency:

• Lines of public security documentation: 9,500+
• Open source repositories: 11+
• Security policies published: 15+
• Compliance standards documented: 8+

Privacy Transparency:

• Categories of PII collected (Provii): 1 (IP addresses only)
• Data retention: IP addresses ~90 days; critical security events up to 365 days
• Third-party data sharing: 2 service providers (Cloudflare, GitHub)
• Sub-processors for downpipes customer data: 0 (no-custody — Maelstrom holds no customer keys or data)
• User tracking: 0 (no persistent identifiers)

Operational Transparency:

• Security incidents: 0
• Data breaches: 0 (no PII to breach; no-custody for downpipes)
• Law enforcement requests: 0
• Data subject access requests: 0 (pre-production)
• Cloudflare-data backup: Maelstrom’s entire estate backed up by our own production instance of downpipes

Report Period: 2024-2025 (Pre-Production Phase) Next Report: January 2026 (covering first operational quarter) Questions: contact@maelstrom.au

Document Information

Revision History