Security & Compliance

1. Overview

We are committed to maintaining the highest standards of security for our infrastructure, user data, and computational workflows. This document outlines the technical and organizational measures we implement to protect your research data and account information.

2. Infrastructure Security

MATONE's infrastructure is designed with defense-in-depth principles:

• All production services are hosted on Oracle Cloud Infrastructure (OCI) with enterprise-grade physical and logical security controls.
• Public web traffic is served through Cloudflare's network edge, which sits in front of our servers.
• Software dependencies are monitored with automated update alerts and upgraded through our continuous-integration pipeline.
• Cloudflare provides DDoS mitigation at the network edge, and the application enforces per-IP rate limits and login lockout.
• Uploaded files are checked by their actual content rather than their extension, and file paths are validated to block directory traversal.

3. Data Protection

We implement multiple layers of encryption and data protection:

• Connections between your browser and matone.one are encrypted with HTTPS (TLS).
• Calculation inputs, results and account information are stored on cloud storage that our hosting provider encrypts at rest (AES-256).
• Sign-in history stores IP addresses only in hashed form and is deleted after 90 days.
• The database is backed up automatically every day and the 7 most recent backups are kept. Backups are stored with the service, not in a separate region.

4. Authentication & Access Control

MATONE employs robust authentication and authorization mechanisms:

• User sessions are managed through JSON Web Tokens (JWT) with short-lived access tokens and secure refresh mechanisms.
• Passwords are hashed using PBKDF2-SHA256 with high iteration counts and unique per-user salts.
• Role-based access control (RBAC) restricts access to administrative functions and sensitive endpoints.

5. Cloud Compute Security

Cloud compute instances are secured through multiple complementary controls:

• Cloud worker instances are provisioned and managed by the platform operator, and your jobs, inputs and results are scoped to your account.
• SSH access uses key-based authentication only, with password authentication disabled.
• Instance-level firewall rules restrict inbound traffic to authorized ports only.
• Privileged administrative actions (such as account deletions and plan or quota changes) are recorded in an audit log.
• Worker health is tracked with heartbeats, and resource usage is visible in the operator's monitoring console.

6. AI Safety & Model Security

MATONE implements multiple safeguards for AI-assisted workflows:

• The AI does not run code it writes. It can only choose among a fixed set of deterministic tools, and the parameters it proposes are validated before any calculation runs.
• User inputs and AI-generated parameters are validated against physically reasonable bounds before execution.
• Computational outputs are validated through automated convergence and plausibility checks.
• We do not use your research data to train or fine-tune AI models. Data received by an external provider's model — including the default model, SKT's A.X-K2 — is handled under that provider's own terms; to keep a conversation on our servers, pick EXAONE 4.5 33B in the chat model picker.

7. Incident Response

MATONE maintains a structured incident response process:

• Security events and reports are investigated by the service operator as soon as they are detected or received.
• Immediate containment measures are enacted upon detection, including system isolation and credential revocation.
• Affected users are notified within 72 hours of confirming a data breach.
• Post-incident reviews are conducted with root cause analysis and corrective actions.

8. Compliance

MATONE's security practices comply with applicable regulatory frameworks:

• We implement measures consistent with the EU General Data Protection Regulation (GDPR).
• We comply with Korea's Personal Information Protection Act (PIPA).
• We conduct periodic internal security reviews.

9. Contact

To report a security vulnerability or concern, please contact our security team at security@matone.one. We support responsible disclosure and will acknowledge receipt within 24 hours.