Trust & compliance — built to EU and US rules alike.
The technical, data-handling and regulatory evidence your architecture, security and procurement review needs — verifiable, documentable, and built in from layer one, on both sides of the Atlantic.
Evidence, not assurances.
Verifiable, documentable security posture — every claim below is backed by an artifact your team can file.
ISO 27001
Information-security management aligned to ISO 27001 — controls mapped to Annex A, evidenced on request. ISO 42001 (AI management system) readiness underway.
GDPR-native
Privacy-by-design and by-default. Lawful-basis mapping, DPIA support, data-subject workflows built in.
SOC 2-aligned controls
Security, availability and confidentiality controls aligned to SOC 2 trust criteria.
Independent pen-testing
Annual third-party penetration testing and continuous dependency scanning across the stack.
Every EU rule that applies to agentic AI, covered from day one.
GDPR, the EU AI Act, NIS2 and DORA aren't a retrofit — they shape the architecture from the first sprint.
Built for the compliance landscape you're already facing.
State-level AI and privacy rules are live today, with more taking effect in 2027 — we build to the strictest one that applies to you.
For US companies with EU customers: if your AI's output reaches people in the EU, the EU AI Act can apply to you. We build to it by default, so that isn't a rebuild later. Guide: the EU AI Act for US companies →
Your data stays where you tell it to.
EU-resident hosting is the default and sits outside the reach of the US CLOUD Act. Sovereignty is a design choice: run in an EU region with EU providers, in a US region on request, or deploy fully self-hosted open-weight models inside your own perimeter — cloud tenancy, private datacenter or air-gapped — so data never leaves your boundary.
No black boxes. No silent hops.
You can see exactly where data goes, why, and under what control — the answer to the opaque-AI-data-flow fear.
Governed data contracts
Every data movement is an explicit, documented contract. No silent multi-provider relays, no shadow copies. Your DPO can read the full map.
End-to-end lineage
Every model decision logs its inputs, version and policy gate — auditor-grade lineage you can replay, not a black box.
In transit & at rest
TLS 1.3 in transit, AES-256 at rest, customer-managed keys (BYOK/HYOK) where required.
Least-privilege access
Identity inherits from your IdP. Access is role-scoped, time-boxed and fully audited — no standing admin.
Four layers, governed end to end.
Security is architected in from layer one — not bolted on after the demo.
Identity & access
SSO via your IdP, SCIM provisioning, MFA, least-privilege RBAC, full access audit trail.
Network & perimeter
Private networking, segmented VPCs, WAF, secrets management, zero public model endpoints.
Data & governance
Classification, lineage, retention, DLP, and an AI risk register aligned to the EU AI Act tiers and applicable US state AI rules.
Model & ops
Eval gates, guardrails, prompt/version control, rollback, and human-in-the-loop policy where it matters.
A register your DPIA can cite — and a pack your procurement team can file.
Transparent, current and minimal. EU-resident by default; the full list is available under NDA. On request, we send the full procurement pack: security questionnaire answers, the sub-processor list, a DPA, and architecture and data-flow diagrams.
| Sub-processor | Purpose | Region | Safeguard |
|---|---|---|---|
| Microsoft Azure (EU) | Primary cloud & compute | EU (West/North Europe) | EU data boundary · SCCs |
| Databricks (EU) | Data & ML platform | EU | EU residency · DPA |
| Self-hosted models | Inference (sovereign) | EU / customer perimeter | No external transfer |
| Full, current register provided under NDA on request · dpo@celthrac.com | |||
Defensible.By design.
Bring your security questionnaire. We answer with architecture and artifacts, not adjectives.