Your data stays in your jurisdiction.
AssurAI runs where your data already is. The control plane sits in your environment or a dedicated EU tenant, the code it is built on is open for your security team to read, and the AssurAI model is used for defence only.
How we handle your data.
Deployed in your environment
Self-hosted on your infrastructure, or a dedicated single-customer tenant in an EU data centre.
No data leaves the EU
Prompts, responses, logs and evidence are stored and processed in the EU only.
No cross-customer training
Your data tunes your deployment only. It is never used to train for anyone else.
Least access
AssurAI staff have no standing access to customer environments. Support access is granted per case and logged.
Encrypted throughout
Traffic is encrypted in transit and stored data is encrypted at rest.
An auditable record
Every model and tool call is written to a tamper-evident log that you control and can export.
Where everything runs.
Clients
People and agents use their AI tools as before. Their AI traffic routes through the gateway.
Gateway
Enforces policy, runs the AssurAI model and writes the log, inside your environment.
Models
Approved hosted or private models receive only what policy allows.
Evidence
Scores and certificates are computed from the log. Carriers see aggregated evidence only with your consent.
Security details.
- Open core
- The control plane is built on an MIT-licensed open-source project. Your team can read and audit the code that handles your traffic.
- Certifications
- We are preparing for ISO/IEC 27001. Design partners receive our security documentation on request.
- Data processing
- A data processing agreement under Article 28 GDPR is part of every hosted contract. Self-hosted deployments involve no processing by AssurAI.
- Defensive only
- The AssurAI model detects and blocks attacks. We test systems only with their owners' consent and do not conduct or sell offensive capability.
- Vulnerability reports
- Report a vulnerability through the contact page with the topic "Security report". We acknowledge reports within two working days.
Works with
Ask for the security pack.
Architecture, data flows and our data processing agreement, for your security team.
Request a demo