Security and trust
Inside your systems.Under your controls.
Everything we build runs in environments you own, with access you grant, and an audit trail you keep. This page is written for your security team. Send it to them.
Three places. Always under your control.
Your cloud account
The default. We work inside your AWS, Azure, or Google Cloud organization with scoped roles you grant and can revoke. Data never leaves your account.
Your own hardware
GPU racks and workstations we spec and build sit in your server room or colocation cage. Models, weights, and prompts stay on premises.
AzeniQ managed
For teams without a cloud footprint we run isolated, single tenant environments in our AWS organization, in the region you choose.
Six gates every AI action passes through.
We implement layered guardrails around the infrastructure itself, not just the model, so an AI agent can do only what it is supposed to do, and nothing more. No deployment can skip a gate, and the thresholds are yours to set.
- 01
Identity
Every agent and pipeline runs as a named service identity with role based access. No shared credentials.
- 02
Scope
Permissions are granted per tool and per action, least privilege by default, reviewed at every release.
- 03
Input guard
Prompts are scanned for injection and sensitive data is redacted before a model sees them.
- 04
Human approval
Actions above a threshold you set (spend, writes, customer contact) wait for a person to approve.
- 05
Output guard
Responses pass policy and grounding checks, and are rate limited, before they reach a user or a system.
- 06
Audit
Prompts, model versions, tool calls, and decisions are logged to a tamper evident trail you own.
What we do with your data, and what we never do.
- We never train models on client data, and we never mix one client's data with another's.
- Encryption in transit (TLS 1.2 or higher) and at rest, with customer managed keys where the platform supports them.
- Secrets live in a managed vault, never in code, config, or chat.
- AzeniQ staff access client environments by exception, through your identity provider, with the session logged.
- At the end of an engagement our access is revoked and we confirm it in writing. Nothing of yours stays with us.
Targets we design to.
- Recovery point objective
- 1 hour
- typical target we design to
- Recovery time objective
- 2 hours
- typical target we design to
- Failover
- Multi AZ
- multi region on request
- Critical patch window
- 24 hours
- 72 hours high, 7 days medium
Figures are the targets we design against on a typical engagement; your contract states the ones that apply to you.
Our controls, stated plainly.
Zero trust by default
Every request is authenticated and authorized, whether it comes from a person, a pipeline, or an AI agent. Nothing is trusted because of where it sits on the network.
Least privilege access
Role based access and short lived OIDC credentials for humans and automation alike. No long lived keys in CI, no shared admin accounts.
Encrypted in transit and at rest
TLS everywhere, customer managed keys where the platform allows it, and secrets held in a managed vault rather than in code or config.
GDPR and CCPA ready
Data minimization, retention rules, and subject access paths designed in from the first architecture review, not bolted on before launch.
Evidence on file
SBOMs, policy as code checks, and a tamper evident audit trail, so a compliance review starts from proof rather than promises.
NDA before discovery
We sign a mutual NDA before the first architecture conversation, and client data never leaves the region or account it lives in.
The vendors behind azeniq.com.
What runs this website and our own operations. Client environments use only the vendors you approve.
| Vendor | Purpose | Data |
|---|---|---|
| Amazon Web Services | Hosting for azeniq.com and the contact form (us-east-1) | Form submissions |
| GitLab | Source control and CI for our own code | No client data |
| Calendly | Call scheduling | Name and email of the booker |
| Google Workspace | Email and documents | Correspondence |
What security teams ask first.
Do you train models on our data?
No. Never. Fine tuning, when it happens, uses your data in your environment and the resulting weights are yours.
Can an agent act without a human?
Only within limits you set. Reads and low risk actions can run unattended; writes, spend, and customer facing actions wait for approval until you choose to widen the scope.
Who at AzeniQ can see our environment?
The named engineers on your engagement, through your identity provider, with access that you grant and can revoke at any time.
Do you hold SOC 2 or ISO 27001?
We will only show a certification badge on this page once the report is in hand. Ask us for the current status and we will tell you plainly, including timelines.
Can you sign our DPA and security addendum?
Yes. We sign a mutual NDA before discovery and review your DPA, security addendum, and vendor questionnaire as part of onboarding.
What happens to our data when the engagement ends?
Our access is revoked, any working copies we hold are deleted, and we confirm both in writing within 30 days.
Send this to your security team.
Then book a call. We will walk through your questionnaire line by line.