Trust Center
Our internal audit is under way in Scrut.io, and the third-party audits for SOC 2, ISO 27001, and ISO 42001 come after it. This page tells you where each certification stands, lists our sub-processors, and gives your security team a direct line.
Direct contact: security@pyramyd.ai · Legal: legal@pyramyd.ai
Audit status
No certification is issued yet. Our internal audit is under way in Scrut.io — each item below shows what's in place and what remains before the third-party audit.
Our controls are tracked and tested in Scrut.io, and our internal audit is under way there. Our independent auditor is engaged; the SOC 2 Type 2 audit period has not started yet, so there is no SOC 2 report yet. Ask security@pyramyd.ai for the current status under NDA.
Our information security management system is implemented and tracked in Scrut.io, and our internal audit is under way there. The certification audit by an accredited body follows it.
Our AI management system controls are implemented and tracked in Scrut.io, and our internal audit is under way there. The certification audit by an accredited body follows it.
GDPR controls are tracked in Scrut.io, and our internal readiness audit is under way. They will be evidenced within the SOC 2 and ISO 27001 third-party audits. A DPA is available on request. Stored data is hosted in the US (Azure Central US); AI requests also run in Azure regions in the EU (see the sub-processors below).
Privacy notices, retention schedules, and opt-out (Do Not Sell or Share) controls are in place and tracked in Scrut.io, and our internal readiness audit is under way. They will be evidenced within the SOC 2 and ISO 27001 third-party audits.
Generated images carry a machine-readable AI marker today. Text disclosure and marking for APEX answers are being built.
Sub-processors
We review this list every quarter. Each sub-processor is bound by a data-processing agreement, and we give at least 30 days' written notice before a new or replacement sub-processor processes personal data.
| Sub-processor | Region | Purpose |
|---|---|---|
| Microsoft Azure | US (Central US); Front Door edge: global | Cloud hosting — compute (Container Apps), PostgreSQL, storage, Key Vault, the edge network and CDN (Front Door), transactional email |
| Okta (Auth0) | US | Authentication and identity |
| OpenAI / Azure OpenAI | US (Azure regions); fails over to EU (Sweden Central, Poland Central) | LLM inference for AI features |
| Anthropic | EU (Azure account in Sweden Central) | LLM inference (Claude family) for AI features |
| Cloudflare | US | DNS, CDN, and web application firewall |
| Stripe | US / global | Payments and subscription billing |
| Sentry | US | Application error tracking (PII-scrubbed) |
| GitHub | US | Source-code management and CI |
| Google Workspace | US | Internal email and document collaboration |
| HubSpot | US | Marketing, CRM, and email |
| Intercom | US | Customer support |
| Apollo.io | US | Sales intelligence |
Artifacts on request
Available under NDA via direct request. Most responses turn around within one business day.
Send us your security questionnaire and we will answer it.
Data Processing Agreement and complete sub-processor list.
Incident classification, communication timeline, customer notification SLAs, and historical incident log.
Incident response
Detailed incident response plan available under NDA at security@pyramyd.ai.
Send us your security questionnaire, or ask legal@pyramyd.ai for the DPA. We're responsive because we've been on the other side of this conversation.