// What we implement today. Not what we plan.

Security posture in plain English.

SLASHED is a young company. We will not list certifications we have not earned, audits we have not completed, or controls we have not yet built. This page lists what actually exists today — and what doesn't.

— Honest posture · what's live · what isn't

No theatre. No fake badges.

Procurement teams deserve a declarative split between what we actually do and what we do not yet do. Here it is.

// LIVE TODAY
// NOT YET
01 · IN PLACE
HTTPS everywhere
All endpoints — api.slashed.pro, dashboard.slashed.pro, status.slashed.pro — served over TLS only. No plaintext fallback.
01 · NOT YET
SOC 2 Type II
We have not completed a SOC 2 audit. We will not display a SOC 2 badge until a report has been issued by a third-party auditor.
02 · IN PLACE
Per-key isolation
Each customer API key (sl-...) is a distinct credential with its own usage record. Keys are revocable at any time from the dashboard.
02 · NOT YET
ISO 27001 / HIPAA
No ISO 27001 certification. No HIPAA BAA. Do not route protected health information through SLASHED.
03 · IN PLACE
Published rate card
Every supported model carries a public per-token price on the homepage. We do not inject system prompts or modify user content before forwarding to the upstream provider — token counts reflect the exact payload sent on the wire.
03 · NOT YET
Third-party pen-test
We have not commissioned an external penetration test. When we do, the executive summary will be available under NDA — not before.
04 · IN PLACE
OpenAI-compatible response shape
Assistant output is returned in the standard OpenAI-compatible content field — the same shape your existing OpenAI SDK already expects.
04 · NOT YET
Standard DPA
We do not yet publish a Data Processing Agreement. Buyers who need one before signing should email — we will tell you honestly when we expect to have one drafted.
05 · IN PLACE
Public status page
Live operational status at status.slashed.pro. Incidents are posted there, not hidden in a support queue.
05 · NOT YET
Self-hosted / BYOC edition
No on-prem or bring-your-own-cloud deployment is available today. If sovereignty rules you out as a SaaS customer, that's an honest no — for now.
All systems operational
status.slashed.pro →
— Sub-processors · upstream providers we route to

Where your requests actually go.

SLASHED is a routing layer. Inference happens at the model providers. The current list of upstream providers we route customer traffic to is published on its own page so it can be cited verbatim in a security questionnaire.

Current upstream providers

Anthropic, OpenAI, Google. Each request is routed to exactly one upstream provider, selected by the model ID supplied in your request.

The canonical, version-dated list — including the legal entity, jurisdiction, and what data is passed — lives at:

→ slashed.pro/sub-processors
— Manifest · one block · paste into your questionnaire

The cold version. Paste-ready.

For procurement teams that need to lift answers verbatim into a security questionnaire.

// TRANSPORT:      HTTPS (TLS) on all customer-facing endpoints.
// KEY MODEL:      Per-customer API key (sl-...). Revocable from the dashboard.
// SUB-PROCESSORS: Anthropic, OpenAI, Google. Full list at /sub-processors.
// RESIDENCY:      No multi-region guarantee. Requests route to the provider's
                  default endpoint.
// CERTS:          None claimed. No SOC 2. No ISO 27001. No HIPAA BAA.
// DPA:            Not yet published. Email to request status.
// PEN-TEST:       None commissioned to date.
// STATUS:         status.slashed.pro — live, public, version-tracked.

If a question on your form is not answered above, the honest answer is "we do not have that control or document yet." Write to hi@slashed.pro — a founder replies, not a queue.

— Contact · founder reply, not a queue

Questions a buyer asks before signing.

If you need a specific control in place before SLASHED can be on your vendor list, tell us which one. We will tell you whether it exists today, when we expect to have it, or that we do not plan to build it. No discovery decks. No "talk to sales" detour.

Email a founder →