Hypotenuse AI — trust-center changed (review)

Hypotenuse AI's trust centre page changed on 15 Nov 2026, with two paragraphs added or removed across the 8 Nov 2026 and 15 Nov 2026 archived copies, seven days apart, touching opt-outs (4), retention (4) and training (2). The record logs 31 changes in total, timestamped 08:31 UTC on 15 Nov 2026, and covers security controls including MFA for administrative, application, critical-service and infrastructure access, encryption at rest and in transit, and penetration testing performed within the last 12 months. The revision matters to customers assessing how Hypotenuse AI handles data opt-outs, retention and model training.

Notable change Hypotenuse AI's trust centre changed 2 paragraphs changed on 15 Nov 2026, touching opt-outs, retention and training. Below is every paragraph added or removed, from two archived copies of the page. Nothing here is a written summary. The record - 15 Nov 2026 - 15 Nov 2026, 08:31 UTC - 8 Nov 2026 https://isittrainingonme.com/evidence/hypotenuse/11e8e648de4f/2026-11-08T07-58-55Z/ and 15 Nov 2026 https://isittrainingonme.com/evidence/hypotenuse/11e8e648de4f/2026-11-15T08-31-18Z/ , 7 days apart - opt-outs 4 , retention 4 , training 2 - 31 The full verdict on Hypotenuse AI https://isittrainingonme.com/app/hypotenuse/ What actually changed Updated 19 minutes ago Updated 35 minutes ago Access Control and Authorization Access granting process used Account inventory maintained Dormant accounts disabled Employee access regularly reviewed MFA required for administrative access MFA required for applications MFA required for critical services MFA required for infrastructure access Password management policy enforced Data Management and Protection Data encrypted at rest Data encrypted in-transit Data inventory maintained Data management and retention policy established Disaster Recovery Automated backups enabled Business continuity and disaster recovery policy established Data recovery process established Disaster recovery plans tested Recovery data isolated Email Security DMARC policy and verification used Email account access restricted Email settings block malicious content Endpoint Security Anti-malware deployed on end-user devices Data encrypted on end-user devices Firewall maintained on end-user devices Mobile device management MDM used Infrastructure Security Active discovery tools used Automated security scanning performed on infrastructure Buckets not exposed publicly Configuration management system established Firewall restricts public access to infrastructure Infrastructure changes logged Infrastructure changes require review Infrastructure deployed using an infrastructure-as-code tool Production deployment access restricted Unauthorized assets addressed and removed Unique production database authentication enforced VPN used Web Application Firewall WAF used Monitoring and Incident Response Audit log management process maintained Audit logs collected Incident response policy established Infrastructure performance monitored Log management used Network infrastructure monitored Organizational Security Acceptable use policy established Asset inventory maintained Asset management policy established Code of conduct acknowledged by contractors Code of conduct acknowledged by employees Code of conduct established Company security commitments externally communicated Confidentiality Agreement acknowledged by contractors Confidentiality Agreement acknowledged by employees External support resources available i.e., documentation Offboarding process established Onboarding process established Performance evaluations conducted Physical access restricted Reference calls performed for employees Roles and responsibilities specified Security awareness training conducted Service description communicated Software development lifecycle established System changes externally communicated System changes internally communicated Risk Management Risk assessments performed Risk management policy established Vendor inventory maintained Vendor management program established Vulnerability Management Automated software patch management performed Penetration testing findings remediated Penetration testing performed within the last 12 months Vulnerabilities scanned Vulnerability management policy acknowledged by employees Vulnerability management policy established Access Control and Authorization Access granting process used Account inventory maintained Dormant accounts disabled Employee access regularly reviewed MFA required for administrative access MFA required for applications MFA required for critical services MFA required for infrastructure access Password management policy enforced Data Management and Protection Data encrypted at rest Data encrypted in-transit Data inventory maintained Data management and retention policy established Disaster Recovery Automated backups enabled Business continuity and disaster recovery policy established Data recovery process established Disaster recovery plans tested Recovery data isolated Email Security DMARC policy and verification used Email account access restricted Email settings block malicious content Endpoint Security Anti-malware deployed on end-user devices Data encrypted on end-user devices End-user devices monitored for security compliance Firewall maintained on end-user devices Infrastructure Security Active discovery tools used Automated security scanning performed on infrastructure Buckets not exposed publicly Configuration management system established Firewall restricts public access to infrastructure Infrastructure changes logged Infrastructure changes require review Infrastructure deployed using an infrastructure-as-code tool Production deployment access restricted Unauthorized assets addressed and removed Unique production database authentication enforced VPN used Web Application Firewall WAF used Monitoring and Incident Response Audit log management process maintained Audit logs collected Incident response policy established Infrastructure performance monitored Log management used Network infrastructure monitored Organizational Security Acceptable use policy established Asset inventory maintained Asset management policy established Code of conduct acknowledged by contractors Code of conduct acknowledged by employees Code of conduct established Company security commitments externally communicated Confidentiality Agreement acknowledged by contractors Confidentiality Agreement acknowledged by employees External support resources available i.e., documentation Offboarding process established Onboarding process established Performance evaluations conducted Physical access restricted Reference calls performed for employees Roles and responsibilities specified Security awareness training conducted Service description communicated Software development lifecycle established System changes externally communicated System changes internally communicated Risk Management Risk assessments performed Risk management policy established Vendor inventory maintained Vendor management program established Vulnerability Management Automated software patch management performed Penetration testing findings remediated Penetration testing performed within the last 12 months Vulnerabilities scanned Vulnerability management policy acknowledged by employees Vulnerability management policy established End-user devices monitored for security compliance Mobile device management MDM used