Trust Center
Your data. Your rules. Your environment.
Built to your industry's security standard, inside an environment you control.
Commitments
Four commitments in every engagement.
Your data never trains a model.
Model terms exclude your data from training. Zero retention where available.
You choose where it runs.
Data stays inside the boundary you set.
People approve what matters.
Anything that moves money, reaches a customer, or carries a compliance consequence waits for a named person.
Every action is recorded.
Who acted, what changed, which model, and who approved it.
Deployment
It runs where your data is allowed to be.
- 01
Your cloud
AWS, Microsoft Azure, or Google Cloud, inside your tenancy.
- 02
Government clouds
AWS GovCloud (US) and Azure Government.
- 03
Your data center
Open-weight models on hardware you own.
- 04
Isolated networks
Air-gapped, with no outside connection.
Frameworks
Built to the frameworks your auditors use.
Healthcare
- HIPAA Privacy and Security RulesProtected health information
- HITECHBreach notification and enforcement
- Business associate agreementsVendors that handle health information
- HITRUST CSFHealthcare security framework
- 42 CFR Part 2Substance use disorder records
Financial services
- GLBA Safeguards RuleCustomer financial information
- FFIEC guidanceBank technology examinations
- SR 11-7 model risk managementModel risk management
- PCI DSSPayment card data
- SEC Rule 17a-4Broker-dealer record retention
- NYDFS Part 500Cybersecurity for financial services
Defense and government
- CMMC 2.0Defense contractor cybersecurity
- NIST SP 800-171Controlled unclassified information
- DFARS 252.204-7012Covered defense information
- ITAR and EARExport controls
- FedRAMP environmentsAuthorized federal cloud environments
- NIST SP 800-53Federal security and privacy controls
Across industries
- SOC 2Trust services criteria
- ISO/IEC 27001Information security management
- NIST CSF 2.0Cybersecurity risk management
- NIST AI RMFAI risk management
- ISO/IEC 42001AI management systems
- CCPA and CPRAConsumer privacy rights
These are requirements we design to and operate within inside your program. They are not certifications or attestations held by SRV LAB.
Practices
How we protect what you trust us with.
Data protection
- TLS 1.2 or higher in transit. AES-256 at rest.
- Customer-managed keys where supported
- Redaction before any model call
Access and identity
- Single sign-on with your identity provider
- Multi-factor authentication and least privilege
- A scoped identity for every agent
AI governance
- An approval mode for every workflow
- Testing before release and after every change
- Any agent can be paused at any time
People and process
- Named staff with a need to know
- U.S.-person staffing for CUI and export-controlled work
- Incident response under your plan
Security reviews
We complete your security review.
SIG, CAIQ, and HECVAT questionnaires. Your architecture review. Your change process.