Compliance & Certifications

ISO/IEC 27001 & 27002

Information Security Management

AntiMatter AV's information security management system (ISMS) is designed in alignment with ISO 27001 requirements. Our controls cover:

• Risk assessment and treatment methodology
• Access control and user authentication (JWT + bcrypt)
• Cryptographic controls (SHA-256, TLS 1.3, AES)
• Incident management and response procedures
• Business continuity planning
• Supplier relationship security (ISO 27002 Annex A)

ISO/IEC 27701

Privacy Information Management

Our privacy management extends ISO 27001 with PIMS (Privacy Information Management System) controls:

• Privacy impact assessments for all features
• Data subject rights management (access, erasure, portability)
• Lawful processing and consent management
• Third-party data processing controls
• Cross-border data transfer safeguards

GDPR (European Union)

General Data Protection Regulation

• Lawful Basis: Contract performance (license agreement) and legitimate interest (security protection)
• Data Minimization: Only license key, HWID, threat counts collected. No personal files scanned remotely.
• Right to Erasure: Users can request complete data deletion via customer portal
• Data Portability: Export user data in machine-readable JSON format
• DPO: Data Protection Officer designated for GDPR oversight

CCPA / CPRA (United States)

California Consumer Privacy Act

• Right to Know: Full disclosure of data categories collected
• Right to Delete: Account and data deletion upon request
• No Sale of Data: AntiMatter AV does not sell personal information to third parties
• Non-Discrimination: No service degradation for exercising privacy rights
• Opt-Out: Users can opt out of non-essential telemetry

LGPD (Brazil)

Lei Geral de Proteção de Dados

• Legitimate purpose for all data processing
• Transparent data handling practices
• Data subject access and correction rights
• Anonymization and pseudonymization of personal data

PIPL (China)

Personal Information Protection Law

• Informed consent for data collection
• Purpose limitation — data used only for security protection
• Data localization readiness for Chinese market deployments
• Cross-border data transfer impact assessment

Automated Updates

Virus definitions and threat signatures update automatically:

• Delta updates every 6 hours (bandwidth-efficient)
• Full definition sync on first install
• Versioned definitions with rollback capability
• Admin-managed signature uploads with audit trail

Real-time Scanning & EDR

Endpoint Detection and Response capabilities:

• Real-time file system monitoring (create, modify, delete events)
• SHA-256 hash-based threat detection with cached smart scanning
• Automated quarantine of detected threats
• Network traffic monitoring and firewall (VPN-based on Android)
• Full disk scan across all mounted drives (Windows)

CMA Guidelines (UK)

Subscription Fairness

• Clear, upfront pricing with no hidden fees
• Easy cancellation — no complex exit processes
• Renewal reminders sent before subscription expiry
• No service degradation during cancellation period

Data Minimization

Privacy by Design

• Only essential PII retained: email, license key, device identifier
• All file scans performed locally — no files uploaded to servers
• Telemetry limited to: definition version, threat count, scan status
• Location tracking only for parental controls with explicit consent