Trust Center
Our internal audits are under way in Scrut.io, and the final third-party audits for SOC 2, ISO 27001, and ISO 42001 come after them. This page tells you exactly where each certification stands, lists every sub-processor that touches customer data, and gives your security team a direct line.
Direct contact: security@pyramyd.ai · Legal: legal@pyramyd.ai
Audit status
No certification is issued yet. Our internal audits are under way in Scrut.io — each item below shows what's in place and what remains before the final third-party audit.
Controls are implemented and continuously monitored in Scrut.io, and our internal audit is under way. We are awaiting the final independent third-party audit that issues the SOC 2 report. Current status is available under NDA through our Trust Center.
Our ISMS is implemented and evidenced in Scrut.io, and the internal audit is under way. We are awaiting the Stage 2 certification audit by an accredited third-party body.
Our AI management system controls are implemented and tracked in Scrut.io, and the internal audit is under way. We are awaiting the independent third-party certification audit.
GDPR controls are implemented and monitored in Scrut.io, and our internal readiness audit is under way. They will be evidenced within the SOC 2 and ISO 27001 third-party audits. A DPA is available on request. All data is hosted in the US (Azure Central US).
Privacy notices, retention schedules, and opt-out (Do Not Sell or Share) controls are implemented and monitored in Scrut.io, and our internal readiness audit is under way. They will be evidenced within the SOC 2 and ISO 27001 third-party audits.
Generated images carry a machine-readable AI marker today. Text disclosure and marking for APEX answers are being built.
Sub-processors
Reviewed quarterly. Each sub-processor is bound by a data-processing agreement. We'll notify you in writing 30 days before adding a new one.
| Sub-processor | Region | Purpose |
|---|---|---|
| Microsoft Azure | US (Central US); Front Door edge: global | Cloud hosting — compute (Container Apps), PostgreSQL, storage, Key Vault, the edge network and CDN (Front Door), transactional email |
| Okta (Auth0) | US | Authentication and identity |
| OpenAI / Azure OpenAI | US | LLM inference for AI features |
| Anthropic | US | LLM inference (Claude family) for AI features |
| Cloudflare | US | DNS, CDN, and web application firewall |
| Stripe | US / global | Payments and subscription billing |
| Sentry | US | Application error tracking (PII-scrubbed) |
| GitHub | US | Source-code management and CI |
| Google Workspace | US | Internal email and document collaboration |
| HubSpot | US | Marketing, CRM, and email |
| Intercom | US | In-product messaging and support |
| Apollo.io | US | Sales intelligence |
Artifacts on request
Available under NDA via direct request. Most responses turn around within one business day.
Pre-filled answers to the standard 200-question security questionnaire (CAIQ-Lite + SIG-Lite alignment).
Data Processing Agreement and complete sub-processor list (refreshed monthly).
Incident classification, communication timeline, customer notification SLAs, and historical incident log.
Incident response
Detailed incident response plan available under NDA at security@pyramyd.ai.
Pre-filled CAIQ-Lite + SIG-Lite. DPA in two days. We're responsive because we've been on the other side of this conversation.