How companies publicly explain protecting customer data: Flock Safety and TSMC

Two public explanations, two formats

Companies use public pages to explain how they protect customer data. This guide compares two very different examples. The first is a blog post by Flock Safety's chief information security officer, published on March 27, 2026. The second is TSMC's information security page on its investor relations site, read alongside TSMC's 2024 annual report.

The Flock post is written in the first person by a named security leader and answers specific public claims. The TSMC page is written in the company's voice and describes governance, committees and certifications. Each format shows a different part of the security program.

Flock Safety: a CISO answering public claims

The post's summary says the author is the company's security chief. It says that Flock CISO Chris Castaldo explains how layered defenses, specialized teams and third-party partnerships protect customer data. Castaldo writes that he had been with the company for a short time when he wrote it.

Much of the post responds to claims made in YouTube videos. Castaldo frames the discussion with a general statement about software flaws. He writes that vulnerabilities are a part of the development process of hardware and software.

On the November 2025 video, the post says the original contact came outside Flock's formal disclosure channel. According to the post, the researcher first contacted Flock by email rather than through the bug bounty program. The post says Flock's own teams reviewed the submission and found that the issues were already known. It also says the findings were legitimate but all of low severity, and that the device had never been deployed to a customer.

On the January 2026 video about PTZ cameras, the post gives a cause tied to a supplier. It says a carrier partner moved some cameras off Flock's private network. The post says this briefly exposed a diagnostic interface to the internet, and that it did not allow access to the cloud environment. It lists three responses: fixing the configuration with the carrier, building internal detections for the change, and adding authentication to the diagnostic interface.

How Flock describes its team and controls

The post lists controls across the software lifecycle and presents them as a baseline. It says buyers should expect any vendor to carry out these practices, which Flock says it follows. The list runs from threat modeling at the design stage, through static and dynamic code analysis, to attack surface management and penetration testing.

Castaldo gives figures for team size and growth. The post states that Flock has more than 20 engineers and plans to hire 10 more this year. It names six functions: Product Security & Privacy, DevSecOps, GRC Engineering, Offensive Security & Vulnerability Operations, Physical Security, and Incident Response & Adversary Pursuit. The incident team handles both response and threat hunting.

The post explains that Flock devices run a modified version of Android built on Qualcomm's version for its chipsets. It says features such as SMS have been removed. On patching, it describes a contractual commitment to customers.

For outside assurance, the post lists SOC 2 Type II, several ISO standards (27001, 27701, 27017, 27018 and 42001), and law enforcement standards including CJIS and FedRAMP 20x. It calls SOC 2 a floor, not a certification. It also cites a customer-run review by a law enforcement agency.

The post closes by stating what the CISO will not promise.

TSMC: governance through committees and reporting lines

TSMC's page starts with board oversight rather than specific incidents. It says the board gave oversight of information security to one committee. It names the committee chairman, Sir Peter Bonfield, and says he has a background in information security.

The CISO role at TSMC is held by a senior operations executive. The page says the company named Cliff Hou to the post. He leads the Global Security Management (GSM) organization and chairs two committees.

The page sets out a reporting schedule. GSM executives report to the board committee twice a year. The PIP (Proprietary Information Protection) & Risk Committee includes vice presidents from Legal, Human Resources, R&D and Operations, and it meets quarterly. The IT Security Committee meets more often.

TSMC's certifications, controls and scale

TSMC's page gives a long certification record. It says the company has held ISO 27001 continuously for many years. The page gives a current end date for the certificate. It says the scope covers customer design and manufacturing information for 300mm wafer production in Tainan. The page also mentions ISO/IEC 15408 certification covering processes from mask design to wafer shipment and scrap.

The listed controls are specific to manufacturing. One measure addresses infected equipment entering a fab. The page lists ten yearly focus areas, including supply chain security and incident handling. It also describes employee reporting channels with rewards for reporting.

The 2024 annual report shows the scale behind these commitments. It says TSMC made 11,878 products for 522 customers. It also reports a workforce of more than 83,000 people. The table of contents lists a section on Information Security Management within Operational Highlights.

What the two explanations reveal

The two documents put weight in different places. The Flock post names team functions, gives headcount, and explains how particular findings were handled, including a supplier configuration change and the fixes that followed. The program it shows is centered on product security, vulnerability handling and incident response, with a CISO who speaks publicly and directly to outside claims.

TSMC's page names the board committee, the CISO, two internal committees and how often each meets. The program it shows is centered on governance and reporting cadence. The CISO is a senior operations executive, and protecting customer proprietary information is tied to manufacturing processes.

Both documents rely on third-party attestation. Flock lists several ISO standards plus SOC 2 and law enforcement standards. TSMC cites ISO 27001 back to 2008 and ISO/IEC 15408. Read together, the documents show that a public data protection statement reflects the business it describes: a device and cloud vendor answering researchers, and a contract manufacturer describing oversight of customer design data.