01
Tenant Isolation
Every customer gets a tenant-isolated graph slice. Customer data is separated by tenant, enforced by row-level security on every tenant table.
Security & Trust
Enterprise-grade by default. Audit-ready by design.
Security built in from day one: tenant-isolated graph slices, row-level security, and an AI transparency model built for the EU AI Act — not bolted on later. Internal audits for SOC 2, ISO 27001 and ISO 42001 are under way; the final third-party audits come after them.
Compliance
The standards your procurement team wants to see.
A short list of acronyms doesn't fit on a wall. A coherent set of audits, certifications, and active regulatory readiness does.
SOC 2 Type 2In progress
Independent SOC 2 Type 2 audit by FinAudit CPA, under way.
ISO 27001In progress
Information security management system certification — the global standard for protecting customer data.
ISO 42001In progress
AI Management System standard · the first certification framework for responsible AI governance.
GDPRIn progress
EU data subject rights, DPA, sub-processor disclosures · readiness in progress.
CCPA / CPRAIn progress
California privacy rights, opt-out endpoints, and public privacy policy with retention schedules · readiness in progress.
EU AI Act Article 50In progress
AI output transparency rules, in force since 2 Aug 2026. Penalties up to EUR 15M or 3% of worldwide turnover. Image marking is live; APEX answer disclosure and marking are being built.
The EU AI Act Article 50 has required AI output transparency since 2 August 2026 · non-compliance penalties up to EUR 15M or 3% of worldwide turnover.
Architecture Controls
Built into the stack, not bolted on top.
Security is a layer of the platform, not a feature flag. Every read, write, and AI generation flows through the same set of controls.
02
Row-Level Security
Row-level security policies enforce per-user, per-role, and per-workspace access. Auth context flows through every read and every write.
03
Encryption in Transit & At Rest
TLS 1.2 or higher in transit. Azure Key Vault-managed AES-256 at rest. Secrets in Azure Key Vault with rotation policies.
04
Audit Logging
Admin, credential and billing actions are logged; audit logs are kept hot for 1 year and archived for 6 years.
AI Governance
Every answer auditable. Every citation traceable.
Agentic AI projects stall when nobody can check where an answer came from. PYRAMYD ships with the citation hierarchy that regulators want and the audit trail that customer security teams need.
Source URLs
Every cited claim links back to a real source — vendor changelog, press release, review, regulatory filing.
Provenance metadata
Retrieval timestamp, last re-verification date, source publication date · stored per signal.
Model + version stamps
Which model wrote the enrichment. Prompt version. Token count. Confidence score per field.
Verification states
verified · needs_review · disputed. Two-gate audit (completeness + content) before APEX can cite a row.
Hallucination guardrails
If the graph can't ground an answer, APEX says so — and links to the closest evidence. No fabricated citations.
Customer-controlled training
Customer data is never used to train shared models.
PYRAMYD is the trusted context layer that keeps them accurate, traceable, and enterprise-ready. Gartner predicts over 40% of agentic AI projects will be canceled by the end of 2027, citing costs, unclear business value and inadequate risk controls (Gartner, 25 Jun 2025).
Data Residency & Subprocessors
No surprises in the DPA.
A full sub-processor list and a DPA on request.
Hosting
Microsoft Azure (Central US). Dedicated virtual network. Managed connection pooling for isolation. Customer-isolated graph slices on every plan.
Data Residency
All data is hosted in the US (Azure Central US). The sub-processor list is published; the DPA is available on request.
Customer Audit
Enterprise customers can request our security documentation under NDA.
Need to talk to security before we talk to procurement?
We'll walk your security team through the architecture, the audit posture, and the AI governance model · before anyone signs an NDA.