Security & Compliance

1. Safeguards

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• FIPS 140-3 validated third-party cryptographic modules where configured for regulated and defense deployments.
• Role-based access control enforced at the API level, multi-factor authentication for administrators, and comprehensive audit logging.
• Faces and license plates blurred at capture in robot imagery; no facial recognition; no biometric identifiers.
• Annual third-party penetration testing and a vulnerability-management program.

2. Hosting and residency

Standard US data is hosted in AWS US regions. US defense data is hosted in AWS GovCloud (US), with no replication outside the United States. Canadian data is hosted in AWS Canada (Central).

3. Certifications and authorizations

Snowbotix does not currently hold third-party security certifications or government authorizations. Our controls are designed to align with the SOC 2 Trust Services Criteria, and a SOC 2 Type II examination is in preparation. We will update this statement only when a certification or authorization has actually been issued.

• Federal cloud. Snowbotix does not hold a FedRAMP authorization. Federal deployments that require one will be scoped under the FedRAMP 2026 Consolidated Rules, including the 20x Certification Class path, as agreed in writing.
• Defense. Snowbotix does not hold a CMMC certification. CMMC Phase 2 requirements apply to applicable Department of Defense solicitations from November 10, 2026; defense deployments are scoped under the applicable defense terms and the DPA.

4. Reporting a security issue

Report suspected vulnerabilities or security incidents, or request our current security documentation, at security@snowbotix.com · Roboworkx Inc. d/b/a Snowbotix, 2701 Airport Drive, Ypsilanti, MI 48198.