Security you can put in front of procurement
AITHEOR is built for banks, government and regulated enterprises. Here's exactly how we handle your data, your credentials, and your instance, and the controls your security review will ask for.
Certifications
SOC 2 Type IIIn progressISO 27001In progressISO 42001 (AI)PlannedGDPRAvailableSOX toolingAvailable
SOC 2 Type II and ISO 27001 are in progress; the live posture doc, sub-processor list and DPA are available under NDA, request access.
Encryption & keys
- • AES-256-GCM for secrets and BYO-AI keys
- • Keys decrypted only server-side; never sent to the browser
- • TLS in transit; SSRF-guarded outbound calls
- • No model training on your data
Access & identity
- • SSO via SAML / OIDC with SCIM provisioning
- • Granular RBAC + custom roles + approval workflows
- • Per-instance OAuth with least-privilege scopes
- • Instance ACLs are always honored
Audit & monitoring
- • Tamper-evident, hash-chained audit log
- • OCSF / CEF export to your SIEM
- • Every build/deploy/change recorded and verifiable
- • GDPR data export & erasure
Deployment & residency
- • Self-hosted or fully air-gapped
- • Run in your own cloud / VPC
- • Bring your own AI model, data stays in your boundary
- • Regional data residency options