Security
Every claim the system makes about itself can be checked.
Built for the buyer who has a regulator. Describes the production deployment on AWS; controls are not yet independently audited.
Your data stays yours
No training on customer data. Personal data is redacted before any model call; full card numbers are rejected at ingest and never stored.
Models inside your boundary
Claude on Amazon Bedrock in our AWS account or yours ('bring your own Bedrock'). The validator also runs with no model at all.
Evidence examiners can recompute
Every finding is a signed record (SHA-256 over canonical JSON) with a write-once copy in S3 Object Lock, compliance mode, seven-year retention.
A tamper-evident audit log
Every submission, finding, label, decision, and report is appended to a per-tenant hash chain. Editing any event breaks every hash after it.
Tenant isolation
Every row carries a tenant id and every query filters on it; per-tenant KMS keys; single-tenant VPC deployment for banks.
Least privilege
Roles named after business actions. An agent's API key can submit and read validations — never review, release, or change a rule.
Compliance roadmap
Continuous controls monitoring from month 2; SOC 2 Type I by month 6 and Type II by month 12. Security questionnaire answers on request.
Eight weeks to an attested AI workload.
A fixed-fee pilot on one workload: an eval report on your historical outputs and an attestation draft for your compliance team.