TRUST CENTER
Security is an architecture decision, not a feature list.
Banks and public institutions trust us with their most sensitive text. This page explains in plain language how we protect it and which documents your security team can request.
Six commitments in every contract
-
01
Data residency
Your data is processed in the region set in your contract (our two Yerevan data centres by default) and is never moved without your written consent.
-
02
No training on your data
Prompts, files and outputs are never used to train or improve our models. Contractually, on every plan.
-
03
Zero-retention mode
Requests can be processed in memory only, with nothing written to disk after the response is delivered.
-
04
Encryption
TLS 1.3 in transit, AES-256 at rest and customer-managed keys for private and on-premises deployments.
-
05
Access and audit
Single sign-on (SAML, OIDC), role-based access and exportable audit logs for every request and every administrative action.
-
06
Human oversight
Evaluation, red-teaming and guardrails designed together with your compliance team, not after the launch.
Frameworks and regulations
| FRAMEWORK | SCOPE | STATUS |
|---|---|---|
| Law of the Republic of Armenia “On Protection of Personal Data” | All services | Aligned |
| EU General Data Protection Regulation (GDPR) | Clients processing data of EU residents; DPA available | Aligned |
| Central Bank of Armenia requirements for outsourcing and IT risk | Private cloud and on-premises for banks | Supported |
| ISO/IEC 27001: information security management | Whole company | In progress |
| SOC 2 Type II | Cloud API and private cloud | Planned |
Status as of September 2026. This page is updated as audits are completed.
Where your data physically lives
- Two sites in Yerevan
- AM-EVN-1 and AM-EVN-2 are separate data centres with independent power and network connections, running active-active.
- Network isolation
- Private deployments receive dedicated network segments, private interconnects and IP allow-lists. GPUs are never shared.
- Monitoring
- Availability, latency and security events are monitored 24/7 by on-call engineers in Yerevan.
- Backup and recovery
- Encrypted backups of configuration and fine-tuned models, with restores tested every quarter.
Models you can explain to a regulator
-
01
Evaluation before release
Every model version is tested for accuracy, bias and safety before it reaches clients.
-
02
Red-teaming
Internal and external specialists attack each release to find failure modes before anyone else does.
-
03
Grounded answers
Assistants cite their sources and say “I don’t know” when the documents do not contain the answer.
-
04
People decide
In credit, legal and medical processes our solutions prepare the decision. People make it.
Available to your security team under NDA
- Security whitepaper
- Data processing agreement (DPA)
- Penetration test summary
- Business continuity and disaster recovery plan
- List of sub-processors
- Information security policy
RESPONSIBLE DISCLOSURE
Found a vulnerability?
Write to [email protected]. We acknowledge every report within one business day, keep you informed until the issue is resolved and never take legal action against research carried out in good faith.