01
Organization Isolation
Every organization's data is kept separate: row-level security in the database enforces it on our core tables, and access checks in the application cover the rest.
Security & Trust
Enterprise-grade by default. Audit-ready by design.
Security built in from day one: each organization's data kept separate, row-level security on our core tables, and an AI transparency model built for the EU AI Act. Our internal audit is under way in Scrut.io; the third-party audits for SOC 2, ISO 27001, and ISO 42001 come after it.
Compliance
The standards your procurement team wants to see.
A short list of acronyms doesn't fit on a wall. A coherent set of audits, certifications, and active regulatory readiness does.
SOC 2 Type 2In progress
Our independent auditor, FinAudit CPA, is engaged. The audit period has not started yet, so there is no report yet.
ISO 27001In progress
Information security management system certification — the global standard for protecting customer data.
ISO 42001In progress
AI Management System standard · the first certification framework for responsible AI governance.
GDPRIn progress
EU data subject rights, DPA, sub-processor disclosures · readiness in progress.
CCPA / CPRAIn progress
California privacy rights, opt-out endpoints, and public privacy policy with retention schedules · readiness in progress.
EU AI Act Article 50In progress
AI output transparency rules, in force since 2 Aug 2026. Penalties up to EUR 15M or 3% of worldwide turnover. Image marking is live; APEX answer disclosure and marking are being built.
The EU AI Act Article 50 has required AI output transparency since 2 August 2026 · non-compliance penalties up to EUR 15M or 3% of worldwide turnover.
Architecture Controls
Built into the stack, not bolted on top.
Security is a layer of the platform, not a feature flag. Here is what each control covers today.
02
Row-Level Security
On our core tables, row-level security policies limit each read and write to the data the signed-in person's organization may see, and the application's database role cannot bypass them.
03
Encryption in Transit & At Rest
TLS 1.2 or higher in transit. AES-256 encryption at rest for every database, backup, and disk. Secrets are stored in Azure Key Vault, with every access logged.
04
Audit Logging
Admin, credential, and billing actions are logged and kept; they are never deleted automatically.
AI Governance
Every answer auditable. Every citation traceable.
Agentic AI projects stall when nobody can check where an answer came from. PYRAMYD shows the sources behind each answer, so your team can check them.
Source URLs
Every cited claim links back to a real source — vendor changelog, press release, review, regulatory filing.
Provenance metadata
When each source was retrieved and when it was published, stored with each signal.
Model stamps
The model that wrote each enriched value, with a quality score and a confidence score for each field.
Verification
Every enriched row goes through a rule-based audit before it is added to search; rows that fail are flagged for review and kept out of search.
Grounded answers
APEX answers from the graph's records and shows the sources it used, and we sample answers to check that their citations hold up.
Customer-controlled training
Customer data is never used to train shared models.
PYRAMYD's agents show the sources behind each answer, so your team can check it before acting on it. Gartner predicts over 40% of agentic AI projects will be canceled by the end of 2027, citing costs, unclear business value, and inadequate risk controls (Gartner, 25 Jun 2025).
Data Residency & Subprocessors
No surprises in the DPA.
A full sub-processor list and a DPA on request.
Hosting
Microsoft Azure (Central US), with a firewall and encrypted connections on every database and pooled, per-request database sessions. Each organization's data is kept separate on every plan.
Data Residency
Stored data is hosted in the US (Azure Central US). AI requests run in Azure regions in the US and the EU: Azure OpenAI starts in the US and can fail over to Sweden Central and Poland Central, and Claude runs in Sweden Central. The sub-processor list is published; the DPA is available on request.
Customer Audit
Enterprise customers can request our security documentation under NDA.
Need to talk to security before we talk to procurement?
We'll walk your security team through the architecture, the audit posture, and the AI governance model · before anyone signs an NDA.