GDPR
Compliant
Standard data-processing agreements available. Data-minimization patterns at every boundary: redaction at source, retention windows, right-to-erasure tooling.
Security & compliance
Honest about what we do and what we don't.
We will not claim certifications we don't hold. Below: where we stand on the major frameworks, plus the data-handling practices that apply to every AISD engagement.
Frameworks
Standards posture.
SOC 2 Type II
Audit in progress
Type II audit underway. Targeted completion Q3 2026. We do not claim certifications we do not yet hold.
HIPAA-aligned
BAAs available
PHI handling patterns established (data minimization, audit logging, on-prem deployment where required). We deliver HIPAA-aligned engagements but do not yet hold a third-party HIPAA attestation.
ISO 27001
Roadmap 2027
On the roadmap. Not actively claimed today.
Practices on every engagement
Six controls we apply by default.
01
Data minimization at the boundary
Agents see only the fields they need to do their job. PII, PCI, and PHI are redacted before they reach the model. Field-level audit logging records exactly what was visible.
02
On-prem and VPC deployment
When state regulators or carrier policy requires it, we deploy open-weight models on dedicated infrastructure with no data leaving your perimeter. AWS GovCloud, Azure Gov, and on-prem options available.
03
Audit-grade logging
Every model call is logged with inputs, outputs, latency, cost, and decision rationale. Searchable and exportable for regulator review (state DOI exams, OIG audits, internal compliance).
04
Prompt-injection defense
Input sanitization, privilege separation between agents that read untrusted content and agents that take side-effecting actions, structured-output schema enforcement, adversarial test suites in CI.
05
Cost caps + circuit breakers
Per-session cost caps, max-step limits, retry / fallback logic. Production AI without these spirals into runaway bills the moment input distribution shifts.
06
Human-in-the-loop on consequential actions
Refunds, account closures, coverage decisions, clinical notes — AI-assisted, not AI-made. The agent surfaces evidence; the human decides.
Reporting a vulnerability
Coordinated disclosure.
Found a vulnerability in an AISD-built system? Email security@aisoftwaredev.io with reproduction steps. We'll acknowledge within one business day and provide a timeline for remediation. We support coordinated disclosure timelines.