Security Whitepaper

Effective date: 2 April 2026 Version: 5.0

Platform Security Architecture and Safeguards.

1. Introduction

This Security Whitepaper describes the security principles, architecture, and safeguards protecting the HostLogic platform. Security, reliability, and privacy are foundational design principles.

2. Security Principles

  • Least privilege access
  • Secure-by-design architecture
  • Defense-in-depth
  • Continuous monitoring and observability
  • Responsible vendor management
  • Separation of concerns (dev/staging/production)

3. Infrastructure

HostLogic is deployed on managed cloud infrastructure including Railway (AI services), DigitalOcean (primary hosting), and Cloudflare (DDoS, DNS), with network segmentation, access controls, and monitoring.

4. Data Protection

Data in transit is protected with TLS. Access is restricted via role-based controls. Credentials are stored in AWS Secrets Manager and never embedded in code.

5. Access Control

RBAC ensures least-privilege access. Authentication and authorization are enforced at all system boundaries.

6. Application Security

Security is integrated into the SDLC through code review, dependency monitoring, parameterized queries, and secure deployment pipelines.

7. Monitoring and Logging

Infrastructure and application events are monitored and logged. Anomaly detection and alerting support rapid incident identification.

8. Incident Response

Defined procedures cover detection, investigation, containment, remediation, and post-incident review. Personal Data Breaches are assessed and Controllers notified per GDPR Article 33.

9. Third-Party AI Risk and Force Majeure

9.1 AI Service Dependencies

The platform relies on Anthropic, OpenAI, ElevenLabs, and Deepgram for AI features.

9.2 Force Majeure — AI Provider Failures

HostLogic's platform relies substantially on third-party AI providers and technology subcontractors, including but not limited to Anthropic PBC (Claude AI), OpenAI LLC (GPT models), ElevenLabs Inc (Conversational AI and Voice), Twilio Inc (Voice and Communications), Deepgram Inc (Speech Recognition), and Railway Inc (Cloud Infrastructure). HostLogic shall not be liable for any interruption, degradation, or failure of the Service caused by: outages, capacity limitations, rate limiting, or service discontinuation by third-party AI providers; changes to AI provider APIs, models, or service terms; capacity constraints such as concurrent session limits; or deprecation or discontinuation of AI models or services. Such events are classified as force majeure events beyond HostLogic's reasonable control. HostLogic will use commercially reasonable efforts to mitigate the impact of third-party AI provider failures, including implementing fallback mechanisms where technically feasible.

9.3 AI Fallback Mechanisms

When AI provider capacity is exhausted (e.g., ElevenLabs concurrent limits), the platform automatically falls back to direct call forwarding. Guest calls are never dropped due to AI provider outages.

10. Vendor Security

Sub-processors are selected based on security posture, reliability, and compliance. Contractual protections are imposed on all vendors. See Subprocessor List.

11. Backup and Recovery

Regular backups, redundancy measures, and tested restoration procedures are in place.

12. Responsible AI Use

AI capabilities operate under human oversight and accountability principles. Customers retain responsibility for operational decisions.

13. Contact

Questions about this Whitepaper: [email protected]