diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..47ffec5
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,22 @@
+# Code of Conduct
+
+Cozystack follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+
+# Cozystack Vendor Neutrality Manifesto
+
+Cozystack exists for the cloud-native community. We are committed to a project culture where no single company, product, or commercial agenda directs our roadmap, governance, brand, or releases. Our North Star is user value, technical excellence, and open collaboration under the CNCF umbrella.
+
+## Our Commitments
+
+- **Community-first:** Decisions prioritize the broader community over any vendor interest.
+- **Open collaboration:** Ideas, discussions, and outcomes happen in public spaces; contributions are welcomed from all.
+- **Merit over affiliation:** Proposals are evaluated on technical merit and user impact, not on who submits them.
+- **Inclusive stewardship:** Leadership and maintenance are open to contributors who demonstrate sustained, constructive impact.
+- **Technology choice:** We prefer open, pluggable designs that interoperate with multiple ecosystems and providers.
+- **Neutral brand & voice:** Our name, logo, website, and documentation do not imply endorsement or preference for any vendor.
+- **Transparent practices:** Funding acknowledgments, partnerships, and potential conflicts are communicated openly.
+- **User trust:** Security handling, releases, and communications aim to be timely, transparent, and fair to all users.
+
+By contributing to Cozystack, we affirm these principles and work together to keep the project open, welcoming, and vendor-neutral.
+
+*— The Cozystack community*
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..f34acd5
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,28 @@
+# Security Policy
+
+## Scope
+
+This is the organization-wide security policy for the [cozystack](https://github.com/cozystack) GitHub organization. GitHub serves it as the default **Security** policy for every repository in the organization that does not carry its own `SECURITY.md`.
+
+The primary project repository, [`cozystack/cozystack`](https://github.com/cozystack/cozystack), maintains its own, more detailed policy — supported versions, response targets, disclosure process and automated security analysis — at <https://github.com/cozystack/cozystack/blob/main/SECURITY.md>. That document governs the Cozystack distribution and the artifacts released from it; this org-level policy governs the other repositories in the organization.
+
+## Reporting a Vulnerability
+
+Please do **not** report security vulnerabilities through public GitHub issues, discussions, pull requests, or public community channels.
+
+Report vulnerabilities privately through one of the following, in order of preference:
+
+1. **GitHub Private Vulnerability Reporting** — open a confidential advisory at <https://github.com/cozystack/cozystack/security/advisories/new>. This is the CNCF-recommended path and routes to the maintainers, who coordinate for any repository in the organization.
+2. **Contact a maintainer** listed in [`MAINTAINERS.md`](https://github.com/cozystack/cozystack/blob/main/MAINTAINERS.md) through a private channel you already have. Reports are triaged by the maintainers responsible for security response — [@kvaps](https://github.com/kvaps), [@lexfrei](https://github.com/lexfrei), [@tym83](https://github.com/tym83), [@matthieu-robin](https://github.com/matthieu-robin) and [@mattia-eleuteri](https://github.com/mattia-eleuteri) — but any maintainer can receive a report and route it.
+
+Please do not include exploit details, credentials, tokens, private keys, or other sensitive material in any public message.
+
+## What to Expect
+
+The maintainers will aim to:
+
+- acknowledge receipt within 3 business days;
+- perform an initial triage and severity assessment within 7 business days;
+- follow a coordinated-disclosure window of up to 90 days from acknowledgement.
+
+Full remediation targets, the disclosure process, and the project's automated security analysis are documented in the primary policy at <https://github.com/cozystack/cozystack/blob/main/SECURITY.md>.