Do you sign a BAA and DPA?

Yes. We sign BAAs for HIPAA-covered projects and DPAs with SCCs where GDPR applies. Subprocessors and data residency are declared in our security documentation.

How do your controls map to common frameworks?

We operate SOC 2-aligned controls, ISO 27001-informed practices, HIPAA-conscious safeguards, and GDPR-ready privacy-by-design. Control mappings and supporting documentation are available under NDA.

How is customer data protected in AI workloads?

Data is encrypted in transit and at rest, scoped to least-privilege access, logged for audit, and optionally confined to regional or on-prem deployments. PII/PHI can be de-identified before model fine-tuning.

Trust Center · SECURITY · COMPLIANCE · PRIVACY

Security posture, documented and ready for review.

SOC 2-aligned controls, ISO 27001-informed practices, GDPR-ready data handling, and HIPAA-conscious architectures for regulated AI workloads.

SOC 2 Aligned GDPR Ready HIPAA Conscious ISO 27001 Informed

Book a security review

Assurance snapshot · 01

Subprocessor discipline

A minimal subprocessor list, reviewed annually, with DPAs in place and least-privilege access.

Documentation freshness

Control documentation kept current, with security and recovery exercises tracked on a defined cadence.

Data residency

EU, US, or on-prem deployment choices, with residency honored per contract and logging scoped to match.

Security response

Documented incident playbooks, clear escalation paths, and customer notification commitments in writing.

Frameworks · 02

Controls mapped to the frameworks your auditors expect.

We say aligned, informed, ready, and conscious, and we mean it. Control mappings and supporting documentation are available under NDA.

SOC 2 Aligned

Controls modeled on the SOC 2 trust services criteria.

✓Role-based access with SSO/MFA enforced
✓Change management with approvals and logging
✓Security reviews with tracked remediation

ISO 27001 Informed

Governance practices informed by ISMS guidance.

✓Risk register tied to the model lifecycle
✓Encryption in transit and at rest by default
✓Incident response and DR playbooks, exercised

GDPR Ready

Privacy-by-design with regional deployment options.

✓DPAs, SCCs, and data mapping on request
✓Data minimization and defined retention
✓Subject-rights workflows designed in from the start

HIPAA Conscious

PHI-conscious architectures for healthcare AI.

✓BAAs, audit logs, and access reviews
✓Network segmentation and vault-based secrets
✓De-identification before any fine-tuning

Documentation · 03

Security documentation, packaged for your review.

Need a DPA, BAA, or subprocessor list? We assemble documentation, diagrams, and control mappings for your framework and region, then walk your security team through them on a call.

Security overview & control mappings Architecture & data-flow diagrams Shared-responsibility matrix

Typically within one business day

NDA-backed, mapped to SOC 2, ISO 27001, HIPAA, and GDPR expectations.

Request the pack

Data handling · 04

Deployment follows your risk posture.

Private VPC, on-prem, or vendor-hosted with strict tenancy: every option uses encryption, isolation, and auditable access.

Private VPC or on-prem deployment KMS-managed encryption keys PII/PHI de-identification pipelines Model evals & red-teaming

Logging & observability

✓Structured audit logs for admin and model actions
✓PII scrubbing in application logs by default
✓Latency and drift monitoring with alerting

Third parties & subprocessors

✓Minimal subprocessors; full list in the security pack
✓Vendor risk reviews and DPAs maintained
✓Data residency respected per contract