Loading page
The question every enterprise buyer asks third, and most AI vendors answer with a logo wall. Here is the actual posture — the controls, where they apply, what we will put in a contract, and where each claim stops.
Every control on this page applies by default — none of it is an enterprise tier.
Not add-ons, and not an enterprise tier. These are how the systems are built in the first place.
Your prompts and completions are not retained by us or by the model providers we route to. Retention is off at the API level, not by policy promise.
VPC, on-premise or air-gapped where the data cannot leave. The Atlas Financial onboarding system runs entirely inside their own estate.
Every tool call, retrieval and model response is traceable. When someone asks why an agent did something eleven months ago, there is an answer.
Retrieval systems can be configured so no answer ships without a source. Vertex Labs cleared theirs for regulatory submissions on that basis.
Detection and redaction before anything reaches a model, with the policy under your control rather than ours.
Automated actions carry a threshold and an authority limit. Below it, work routes to a named human with the uncertain field already highlighted.
Chosen by your security team, not by our convenience. Every one of them has shipped.
We deploy into your AWS, Azure or GCP tenancy. You own the infrastructure, the keys and the bill; we hold time-boxed access that your team can revoke.
Inside your own datacentre, against locally hosted models where a hosted API is not acceptable. Slower to stand up and worth it when the data cannot move.
For estates with no outbound path. Model weights, retrieval indexes and traces all stay inside the boundary, with updates delivered as signed artefacts.
Procurement is where most AI pilots go to die. Here is what we hand over and when, so your security review can start before the contract does.
Document
What it covers
Turnaround
Data processing agreement
Standard DPA, or yours if you have one you prefer to work from.
With the contract
Security questionnaire
We complete yours rather than sending a PDF back. No length limit.
5 working days
Penetration test summary
Most recent third-party summary, under NDA.
On request
Retention and residency terms
Region pinning and retention windows written into the contract, not set in a console.
With the contract
Named subprocessor list
Every model provider and service in the path, with notice before any change.
On request
Everything above is available under NDA before a contract exists — write to infochronixa@gmail.com.
A logo wall implies a certificate. Where we hold one we will show it; where we do not, the wording says so.
Controls mapped to the Trust Services Criteria and operated as described. We are not yet through an audit period, and we will say so on a call rather than let a logo imply otherwise.
Annex A controls implemented across access management, change control and incident response. Certification is not claimed.
Lawful-basis mapping, data subject request handling and EU region pinning available. Standard contractual clauses where a transfer is unavoidable.
Bring one process you think an agent could run. We'll tell you straight whether it's worth building — and what it would cost if it is.