Security
Security you can audit, not adjectives
Sovereignty first — where your data lives, who can reach it, and the evidence your review team actually checks behind every TechRevati deployment.
This page is written for the reviewer, not the browser. Security starts with a simple question: where does your data live, and who can touch it. We lead with that answer, then work down every control a regulated buyer's security assessment, vendor risk questionnaire, or EU AI Act / DORA / GDPR mapping actually checks. Each claim below maps to a mechanism we can demonstrate to your auditor — a database policy, a redaction step, an append-only log, a deployment topology — and nothing more. We deploy EU-sovereign or fully air-gapped on Mistral AI plus Qdrant, so your documents and prompts do not have to leave the jurisdiction — or your building — for the AI to work. Where a certification is not yet held or a guarantee is not absolute, we say so plainly: we describe what is enforced, what is a design property, and what is on the roadmap but not yet held. We would rather lose a deal on an honest "not yet" than win one on a claim your assessment would later unravel. This page is engineering, not legal advice — a description of how we help you meet and prepare for the EU AI Act, DORA, and GDPR, grounded in what we deliver.
Data stays where you put it — EU-sovereign or air-gapped
You choose the deployment boundary, and the AI runs where your data already lives. The EU-sovereign path runs inference on Mistral AI and vector search on Qdrant with EU data residency, so there is no required US data transfer and no CLOUD Act exposure by design. For the strongest assurance we deploy single-tenant on your own infrastructure, on-premise, or fully air-gapped — your documents and prompts never leave your environment. Where a US model is used, that is an explicit, opt-in choice you control, never a default.
Database-enforced tenant isolation, described precisely
Isolation is pushed down into the data engines, not left to application code. PostgreSQL Row-Level Security filters every query by tenant at the database layer, and each tenant gets its own Qdrant vector collection so a misconfigured query does not cross a collection boundary. This is a fail-closed model — but we do not claim a tenant can never reach another's data; no honest vendor should. For the strongest isolation assurance, choose single-tenant or fully air-gapped deployment, where separation is physical rather than only enforced in software, and we document exactly which model your deployment is on.
PII redacted before the model sees your data
Sensitive fields are redacted at the input boundary, before the model ever processes a request, so personal data does not reach the inference layer in the clear. This keeps identifiable information out of inference and out of the context window, advancing your data-minimisation posture and narrowing what personal data GDPR ever puts in scope at the boundary rather than trusting that to a prompt. We can show your reviewer the redaction step in the request path and what it removes.
Prompt-injection firewall and denial-of-wallet caps
Every input passes a prompt-injection firewall that screens for instructions attempting to override system behaviour or exfiltrate context before it reaches the model. Per-tenant spend and rate caps bound token consumption, so a malicious or runaway workload cannot quietly burn your budget or your inference capacity, or turn into a resource-exhaustion incident. Both are inspectable controls, not policy statements.
Immutable, append-only, database-enforced audit trail
Every request, retrieval, and answer is written to an immutable, append-only, per-tenant audit trail enforced at the database layer. It records who asked what, what context was retrieved, and what the system returned — the record your assessor asks for. The evidence is structured so it can be mapped to SOC 2, ISO 27001, and EU AI Act reviews, including the logging and traceability the AI Act expects of deployers under Article 26.
Grounded, closed-context RAG with human handoff
Answers are generated only from your retrieved documents in a closed context, with citations back to source — not from open-ended model recall — which narrows hallucination and keeps every response traceable. When confidence is low or the question falls outside the grounded context, the system hands off to a human rather than inventing an answer. That boundary is configurable and logged, so human oversight is a control you can evidence, not an assumption — which is what oversight obligations actually require.
Certifications, stated honestly
Our controls are mapped to SOC 2 and ISO 27001 evidence, and attestation is on our roadmap — it is not yet held, and we will not claim a certification we do not hold. For healthcare we describe the deployment as a HIPAA-ready architecture, meaning the controls for PHI handling are in place, not that a certification exists. If your questionnaire asks for a certificate we cannot produce, you get a straight answer and the control-to-evidence map that stands behind it.
Regulation framed as engineering — with evidence packaged for your assessment
We help you meet and prepare for the EU AI Act (Regulation (EU) 2024/1689), DORA (Regulation (EU) 2022/2554), and GDPR through concrete delivery: risk-tier and provider-vs-deployer mapping, logging and human-oversight hooks, ROPA and DSAR artefacts, and reduced US-cloud critical-provider and concentration risk. A pilot's deliverable is a review pack, not a demo — an independent security report plus generated evidence for a real use case. This is engineering support for your compliance work alongside your own counsel, not legal advice or a guarantee of compliance.
FAQ
Where does our data actually live, and does any of it reach a US provider?
Where you decide, and it does not have to reach a US provider. The EU-sovereign path keeps data in the EU with inference on Mistral AI and vector search on Qdrant, self-hosted, on-premise, or air-gapped — no required US data transfer and no CLOUD Act exposure by design. For the strongest assurance we deploy single-tenant on your own infrastructure or fully air-gapped, in which case your documents and prompts never leave your environment at all. Where a US model is used, that is an explicit, opt-in choice you control, never a default.
Do you hold SOC 2 or ISO 27001 certification?
Not yet, and we will not say otherwise. Our controls are mapped to SOC 2 and ISO 27001 evidence, and attestation is on our roadmap but is not currently held — we do not claim certifications we do not hold. What we can provide today is the control-to-evidence mapping, an immutable per-tenant audit trail structured for those frameworks, and, during a pilot, an independent security review of the deployment. For healthcare we describe the deployment as a HIPAA-ready architecture, not as HIPAA-certified.
Can you guarantee one tenant can never reach another tenant's data?
We do not use the word guarantee for absolutes. Multi-tenant deployments enforce isolation at the database with PostgreSQL Row-Level Security and give each tenant its own Qdrant vector collection, producing a fail-closed model where the data engines filter cross-tenant records at the query boundary. We do not, however, market this as an absolute guarantee. For the strongest assurance we deploy single-tenant, or fully air-gapped with no shared infrastructure at all, where separation is physical rather than only enforced in software — and we document precisely which model your deployment uses.
How does this help us meet the EU AI Act, DORA, and GDPR?
Through engineering, not legal advice. We help you map use cases to AI Act risk tiers and provider-vs-deployer duties, produce the logging and human-oversight the Act expects of deployers (including Article 26), generate ROPA and DSAR artefacts and enforce data residency and redaction for GDPR, and reduce the US-cloud critical-provider and concentration risk DORA scrutinises for financial entities. This is how we prepare your deployment to meet the requirements alongside your own counsel; it is not legal advice and not a compliance guarantee.
What does our security review get to see before we commit?
A working deployment inside your own environment, and the evidence to check it line by line. Our Sovereign RAG Pilot runs a fixed 6–8 weeks, single-tenant, under NDA, on your infrastructure or an EU-sovereign cloud, wiring one real use case. It includes an independent security review, an EU AI Act and GDPR (ROPA / DSAR) evidence pack, and access to the immutable audit trail — so your review team evaluates real evidence, not slideware, before there is any wider commitment.
Bring us the project your compliance team said no to
The fastest way to clear a security review is to run the system where your data stays. Start a Sovereign RAG Pilot — a fixed 6–8 weeks, single-tenant, under NDA, deployed inside your walls on an EU-sovereign or air-gapped stack — and we hand your review team an independent security report, an EU AI Act and GDPR (ROPA / DSAR) evidence pack, and the audit trail: proof your assessment can check line by line, not slideware. Start a pilot, or write to us first at hello@techrevati.com.
Start a pilot