How SemantiqWall follows the 7 Secure by Design goals

Multi-factor authentication (MFA) Done

MFA is required for every user and can't be turned off. Approving a critical agent action asks for the code again, even with an active session.

Next step: passkeys, which resist phishing.

No default passwords Done

There are no default passwords and no open sign-up. Every account starts with a unique temporary password that expires in 72 hours and must be changed at first sign-in. Passwords have at least 12 characters with upper- and lowercase letters and numbers, and sign-in attempts are rate-limited.

Eliminating entire classes of vulnerability Done

Database queries are always parameterized; HTML is escaped automatically; a Content Security Policy forbids inline scripts and styles; every form is protected against CSRF; third-party websites are only fetched through a client that blocks internal addresses (SSRF); and per-organization isolation rejects any query without an organization set.

Next step: publish the product's threat model.

Security patches In progress

SemantiqWall is a cloud service: a fix reaches every customer the same day, with no action on their part.

In progress: per-version security advisories for the PHP and TypeScript SDKs, which customers install.

Vulnerability disclosure policy Done

A public policy with scope, testing rules, response times and safe harbor for good-faith researchers, plus the contact in /.well-known/security.txt.

See the policy

Vulnerability transparency (CVE) In progress

Published commitment: critical or high-severity flaws affecting customers become a public advisory with the weakness type (CWE) and, where applicable, a CVE ID.

In progress: no advisories published so far; the first one will follow this format.

See the policy

Evidence of intrusions Done

Every customer gets, at no extra cost, an append-only, hash-chained audit trail: sign-ins and failed attempts, MFA, configuration changes, API keys and the decision on every AI agent action. Customers can verify the trail's integrity themselves in the dashboard.