We know AI suppliers to regulated organisations face the hardest questions in procurement. Here are our answers, in plain language.
Deployment inside your network segment or private cloud. Default deny egress at firewall level. No telemetry and no call home. Egress rules verified at installation and monitored continuously.
Single sign on through your identity provider (Entra ID, SAML or OIDC). Role based access. Least privilege service accounts. Electronic signature binding designed in alignment with 21 CFR Part 11 and EU GMP Annex 11.
AES-256 encryption at rest, TLS 1.3 in transit, customer held keys where required. The corpus never leaves your environment.
Retrieved content treated as untrusted. Separation of instructions and data. Every output validated by the deterministic engine before release. Jailbreak attempts logged as incidents. Model files hash verified at deployment.
Software bill of materials, dependency scanning, signed containers and reproducible builds. Vendor assessment pack for your security review.
GAMP 5 lifecycle. Penetration testing before first production deployment and annually thereafter. Tamper evident audit trail.
AI assists. Named people decide and sign.
Nothing is used before it is recorded.
The higher the stakes, the deeper the evidence.
Your data, models and records stay under your control.
We are clear about what our systems do not do, and enforce exclusions in software.
Your information is never used to train or fine tune models.
Our security certification roadmap and vendor assessment pack, including our software bill of materials approach, penetration testing policy and platform risk assessment summary, are available to organisations under NDA.
