Trust, security, and compliance.

Mavrick’s compliance program clock started on April 15, 2026, with continuous internal logging from day one. Type 1 fieldwork with an external auditor is scheduled to begin in mid-2026. A six-month Type 2 observation period is planned to begin immediately following Type 1 issuance, running through Q2 2027.

While the Type 1 certificate is in progress, Mavrick operates to the same trust services criteria the audit measures. The Privacy Charter contractually binds us to those controls. Customers and prospective customers can request the current evidence folder under MNDA.

These are the four hard rules in the Mavrick Privacy Charter. They are contractual commitments, not posture statements. Every change to this list is a published, dated diff.

The following service providers process customer data on Mavrick’s behalf. Each is contractually bound to handle customer data per Mavrick’s Privacy Charter and applicable regulations.

Mavrick maintains a current subprocessor list with notification of material changes. Customers under enterprise plans can request notification before subprocessor changes take effect. Customers may request the most recent vendor security questionnaires under MNDA.

Mavrick publishes the underlying architecture that handles customer data. The following artifacts are public:

• •

  The Mavrick system prompt — every word the agent reads before responding. Versioned. Diffs published when material changes occur.

  Read the system prompt →
• •

  The self-improving architecture — closed-loop design, eight subsystems, seven signal channels, five guardrails. Documented in full.

  Read the architecture documentation →
• •

  The public learning ledger — every approved learning Mavrick has deployed. Includes regression status, approval timestamp, source workspace count.

  See the changelog →
• •

  The decline log — every drafted learning that was rejected by the operator approval gate. With one-line decline reason.

  See the decline log →

This level of architectural transparency is uncommon. We publish it because customers entrusting their marketing data to an AI employee deserve to know exactly what the agent reads, what it can do, what it has learned, and what it has been prevented from learning.

Mavrick maintains a documented Incident Response Plan (IRP) aligned with SOC 2 Trust Services Criteria CC7.3, CC7.4, and CC7.5.

Process summary:

1. 1.
   Detection — Automated monitoring via Sentry; customer-reported incidents via admin@getmavrick.com.
2. 2.
   Triage — Incident classified within 4 hours of detection (severity levels P0 through P3).
3. 3.
   Containment — Isolation of affected systems within 24 hours for P0/P1; within 72 hours for P2/P3.
4. 4.
   Notification — Customers affected by a P0 or P1 security incident are notified within 72 hours of confirmation, via primary workspace contact.
5. 5.
   Resolution — Root cause analysis, remediation, and verification within 14 days of containment.
6. 6.
   Post-mortem — Written post-mortem published within 30 days of resolution. Customer-affecting incidents receive a public post-mortem; internal-only incidents receive a private one.
7. 7.
   Continuous improvement — Every incident generates lessons-learned items that feed the next quarterly compliance review.

The full IRP document is available under MNDA.

Mavrick’s compliance program runs continuously, not as a one-time audit prep effort. The following artifacts are produced on a fixed cadence and stored in the versioned Mavrick Compliance/ evidence folder, available under MNDA.

The clock started on April 15, 2026. Every month since then has a compliance review log entry. Customers and auditors can request the folder under MNDA to verify operational continuity.