Security & AI Transparency

Commerce Brain™ is an executive reasoning engine. It reads signals from your connected commerce, finance, and marketing systems, cross-references them against your Decision Memory (private layer), and produces ranked decisions with evidence and confidence.

• It never invents financial numbers, KPIs, or historical facts.
• It never executes financially material actions without human approval.
• It never blends your Decision Memory (private layer) with another business's data.
• It never trains third-party foundation models on your identifiable business data.

• Password hashing with Argon2id.
• Optional two-factor authentication (TOTP + WebAuthn).
• SSO via SAML 2.0 and OIDC on the Enterprise plan.
• Session revocation on password reset and suspicious login.

Every privileged action is logged with actor, timestamp, and payload hash. Logs are immutable and retained for 400 days.

Role-based access control ships out of the box with Owner, Admin, Operator, and Viewer roles. Enterprise adds custom roles and scoped API tokens.

Documented DR plan with RPO ≤ 15 minutes and RTO ≤ 4 hours. Full DR exercises are executed twice a year.

Our on-call team responds to Sev-1 incidents within 15 minutes. Customers are notified without undue delay of any confirmed incident affecting their data.

Report vulnerabilities responsibly to security@occean.com. We acknowledge receipt within 24 hours and coordinate disclosure with researchers.