Institutional Trust
Defense-in-depth. By default.
Per-tenant isolation. TLS in transit, AES-256 at rest. SSO/SAML with SCIM. Secrets in KMS/HSM. Logs to your SIEM.
- ISOLATION: NAMESPACE + STRICT IAM
- PRIVATE NETWORKING: PRIVATELINK / PEERING
- SIGNED IMAGES, SUPPLY-CHAIN SCANS
Your data, not our model feed.
We don't train on customer data. We pass no-retain/no-train flags to model providers. VPC/on-prem keeps inference inside your perimeter.
- PII/SECRET DETECTORS AT INGRESS
- MINIMAL CONTEXT, SCOPED WINDOWS
- REDACTION + POLICY-BASED BLOCKING
Allowlist routes. Evidence out.
You choose the models. We enforce allow/deny by use case and region. Outputs ship with citations, lineage, and risk checks.
- PROMPT-INJECTION GUARDS
- RETRIEVAL ALLOWLISTS
- REVIEWER QUEUES FOR LOW CONFIDENCE
Pre-compute the obvious. Cache the rest.
PRE/MID/EOD briefs render instantly; deep asks stream in under target SLOs. Cache invalidates on corp-actions, macro prints, and ratings.
- SAAS AVAILABILITY 99.9%
- P95 SCHEDULED <2S
- P95 DEEP <10S
Bank-grade paperwork. Research-grade provenance.
DPA (GDPR/CCPA), residency controls, sub-processor transparency. Research outputs respect entitlements and ship with disclaimers and citations.
- MIFID II / MAR-AWARE PACKAGING
- AUDIT-READY LINEAGE EXPORTS
- ANNUAL INDEPENDENT PENTEST (SUMMARY UNDER NDA)
The same engine - where you want it.
Multiple deployment methods to meet your needs. Hybrid VPC/On-Prem keeps inference inside your perimeter.
SaaS (Multi-tenant or Single-tenant isolation)
Fastest time to value, regional residency, SIEM export.
Your VPC
PrivateLink/peering, your KMS/HSM, strict egress allowlists.
On-Prem (K8s/Helm/Terraform)
Fully inside your perimeter; signed images.
Frequently Asked Questions
Security Pack includes Security Whitepaper, DPA, Shared‑Responsibility Model, Pentest Summary, and Control Matrix (under NDA).