Security Overview

At Centaur.ai, security and compliance are at the heart of our product design process. We follow a full complement of security, data protection and business continuity policies and follow many of the best practices of relevant health information standards. A summary of our practices is below.

Information Security Program

Centaur has successfully completed a SOC 2 Type 2 audit. The SOC 2 provides assurance to our customers that the security controls we have in place are effective and meet the standards set by the American Institute of Certified Public Accountants (AICPA). Our SOC 2 report is available to customers and prospects on request.

We perform annual risk assessments to identify potential risks to our security posture, so we can invest in the areas of our programs that most need improvement.

Our security policies cover a wide range of tasks. They are updated frequently and shared with all employees, who must read and agree to them at least once a year.

All employees complete security and privacy training when they are hired and at least once a year after that. All employees sign a confidentiality agreement.

Infrastructure

We host the Centaur infrastructure on Amazon Web Services (AWS), using AWS management and security tooling. Our services run in private networks that are not reachable from the public internet, and all traffic enters through a single, authenticated API gateway.

Encryption in transit and at rest

All data is encrypted in transit using HTTPS (TLS 1.2 or 1.3).

All persistent data is stored on highly available AWS S3 or Elastic Block Store, which use AES-256 encryption. Our encryption keys are managed through AWS Key Management Service (KMS).

Images and files are delivered to labelers through short-lived, signed links that expire automatically.

Customers can choose to keep data in their own cloud storage. In that case, labelers get temporary access to specific files through signed links, and Centaur keeps only metadata, annotations and results, not permanent copies of your files.

Portal access and authentication

Sign-in options. Users can sign in with email and password, Google, or SAML single sign-on (SSO) through your identity provider.
Enforced SSO. Your organization can require Google or SAML SSO for all users. When SSO is required, password sign-in is turned off for your organization, and removing a user in your identity provider removes their access to the portal.
Multi-factor authentication. For organizations that need it, Centaur can require multi-factor authentication (an authenticator app) at sign-in, including for labelers who work on your tasks in the portal. Contact your account team to turn this on.
Roles and permissions. Each user belongs to an organization and has a role plus granular permissions, such as which projects they can see, whether they can download results, and whether they can see labeler identities. Users can only access data in their own organization.
Account protection. Accounts are temporarily locked after repeated failed sign-in attempts. Sessions end after a period of inactivity and after a maximum session length. Passwords must meet complexity requirements and are securely hashed and salted.

Who can access your data

Access to every task is controlled by rules Centaur sets up with you before labeling starts. Depending on your requirements, a task can be limited to:

A named list of approved labelers, or all labelers except a named list
Labelers who have signed a Business Associate Agreement (BAA)
Labelers who have passed identity verification, a background check, or both
Labelers with verified credentials, specialties or licenses
Labelers who have passed a qualification round for your task
Labelers in specific countries

Sign-in and sign-up are blocked from sanctioned and restricted countries, based on the location of the connection.

Labelers only see the cases served to them for the task they are working on. They cannot browse, search, bulk download or share your dataset.

Labeling app security (DiagnosUs)

Screen capture. Screenshots and screen recording are blocked on labeling screens on iOS and Android.
No saving or sharing. Security measures block users from saving, exporting, or scraping files and assets being labeled.
Account protection. New accounts verify their email address. Accounts are locked after repeated failed sign-in attempts, and the app checks device integrity.

Activity records and traceability

Centaur keeps a record of who worked on your data:

Every batch of cases served to a labeler, including the labeler, the cases, the task, the device, and when it was served and completed
Every label submitted and every case flagged, with the labeler and time
Portal sign-ins and requests, including the user, organization and time

On request, we can provide a report of the labelers who accessed your task and the cases each one was served.

Endpoint Security

All employee computers are centrally managed so we can enforce security policies such as administrative access, screen lockout, strong passwords, disk encryption and malware protection.

Identity and Access Management

We use Google Workspace to verify employee identity and require two-factor authentication for apps that access critical infrastructure or customer data. Centaur staff reach internal systems only through our VPN or Google sign-in.

Code Quality

Every change to source code is reviewed before merge by at least one other qualified engineer. Reviews cover performance, security and code quality.

Code is deployed to a testing environment and must pass testing before it is deployed to production.

Our code uses multiple techniques to protect against common application vulnerabilities, such as the OWASP Top 10. Independent third parties run penetration tests at least once a year so we can find and fix any issues in our code or infrastructure.

Monitoring

We monitor our infrastructure for security, performance and availability to keep your data safe and our service available.

Incident Management

We maintain an incident response process for any issue that could affect our security or availability. After an incident, we run a post-mortem and follow up on the lessons learned to improve our processes and product.

Contact us

If you have a security concern or question, or are aware of an incident, email [email protected], a carefully controlled and monitored account.