Security

Operations, isolation, and the audit trail.

Every engagement runs inside a tenant-isolated environment with EU data residency, signed evidence, and a full audit trail. DPIA available on request.

Security & Operations

The infrastructure layer,
audited and locked down.

DATA SOVEREIGNTY
COLUMN-LEVEL ENCRYPTIONPLAINTEXTscenario_idsc_4a7f9ebrief_textMerger riskuser_emailalice@acme.ioapi_tokensk_live_7b2...AES-256-GCMserver-keyCIPHERTEXTAES256GCM01011010256GCM01011010AESGCM01011010AES25601011010AES256GCM
Your scenario data stays yours, encrypted at every layer.
Briefs, reports, and connector credentials are encrypted application-side with AES-256-GCM before they reach Postgres — a stolen database dump is useless without the server-held key. Tenant-isolated at app and DB level.
AES-256-GCM at restTLS 1.3 in transitTenant isolationGDPR-ready
CONTENT INTEGRITY
MULTI-LAYER DEFENCEIGNORE PRIORSANITISED · LOGGEDＳＹＳＴＥＭSANITISED · LOGGED<|END|>SANITISED · LOGGED</sys>SANITISED · LOGGED
Multi-layer defence against adversarial content manipulation.
External inputs pass through a sanitisation pipeline before they ever reach model context. Override phrases are stripped, Unicode homoglyphs normalised, system-marker spoofs blocked — and every attempt is logged.
Injection defenceHomoglyph normalisationRed-team tested
AUDITABILITY
AUDIT LOG · LAST 4 EVENTS
Every decision, every state change, every export — logged.
AlphaGraph maintains a comprehensive audit log of all user actions. Records include user identity, timestamp, and action metadata. The full stream is queryable via API and exportable as CSV for compliance review.
Audit log APICSV exportSOC2 ready
Fact-checked reportsGDPR-compliantEU data residencySHA-256 signedDPIA on request