Security & Compliance
Built for the buying committee.
Everything your security, risk, and compliance teams need to say yes: the architecture, the controls, and the deployment options, documented for review.
Controls
Governed at the AI layer, not bolted on.
No other platform ships a per-answer immutable audit trail, and zero-exfiltration is the architecture here, not a deployment option bolted on later.
Zero-exfiltration by design
Your content, prompts, and answers never leave your boundary. No data is sent to a third-party model or to us.
ABAC at the AI layer
Retrieval and answers are gated by attributes (clearance, role, need-to-know) before an answer is ever formed, not just at the file store.
Immutable audit trail
Every answer is sealed to its source, model, and approver. The log is append-only and tamper-evident.
Verbatim enforcement
Regulated and controlled wording is returned exactly as approved, never paraphrased or summarized away.
Bring your own model
Run a local model in your environment or connect an approved API. No proprietary or closed-source model is required.
Encryption & identity
Encrypted in transit and at rest, with SSO and SCIM so access maps to your existing identity provider.
The boundary
What leaves your environment: nothing.
Retrieval, the model, the answer, and the audit log all live inside your boundary. Sovereignty isn't a setting. It's the architecture.
Deployment
Run it where your policy requires.
Air-gapped
Fully disconnected enclaves. Local models, no outbound network. For the most sensitive programs.
On-premises
In your own data center, under your controls and your change management.
Your private cloud
Your AWS, Azure, or GCP tenancy and region: your keys, your network, your policies.
Compliance
Mapped to the frameworks your auditors use.
The EU AI Act is enforceable now, with penalties up to the greater of €35M or 7% of global revenue for high-risk AI. Provenance, human sign-off, and a full audit trail on every answer are exactly the evidence it asks you to produce.
FAQ
Common questions from security reviews
Does any of our data leave our environment?
No. Retrieval, the model, the answer, and the audit log all run inside your boundary: air-gapped, on-premises, or in your private cloud. Nothing is sent to a third-party model or to Sovrinty.
Which models can we use?
Any model you approve: a local model like Llama, Qwen, or Mistral running in your environment, or an approved API. No proprietary or closed-source model is required.
How is access to answers controlled?
Attribute-based access control (ABAC) is enforced at the AI layer: retrieval and answers are gated by clearance, role, and need-to-know before an answer is ever formed, not just at the file store.
What does the audit trail capture?
Every answer is sealed to its source, its model, and its approver in an append-only, tamper-evident log your auditors can review line by line.
Which compliance frameworks does Sovrinty map to?
Controls are mapped to the frameworks auditors use, including SOC 2 Type II, ISO 27001, HIPAA, ITAR, FedRAMP, and 21 CFR Part 11, and to the provenance, human-oversight, and audit-trail evidence the EU AI Act requires of high-risk AI.
How does Sovrinty fit our identity provider?
SSO and SCIM map access to the identity provider you already run, and data is encrypted in transit and at rest.
Bring your security team.
We'll walk the architecture, the controls, and the audit trail, on your environment.