Your security review, answered.

No — your documents, datasets and prompts are never used to train public models, and they are never shared between customers. Models run inside a closed, Azure-hosted environment that falls within our ISO/IEC 27001:2022 audit scope, so the isolation is a property of how the system is deployed rather than a setting someone could switch off. Client data is encrypted in transit and at rest, and access to it is role-based, logged and monitored. The commitment is written into our AI Policy, not just promised, and the security documentation pack includes the sub-processor list showing which services touch your data at all.

Processing and storage run on Azure-hosted infrastructure inside a closed environment covered by our ISO/IEC 27001:2022 scope, and EU customers can contract with TrialAssure B.V. in Eindhoven, so the contracting entity sits in the EU. Your documents and datasets are handled inside that boundary rather than on shared public services, with encryption in transit and at rest and role-based access, logging and monitoring around them. Exact region and residency options depend on how your instance is deployed, so we set them out in writing in the security documentation pack, alongside the sub-processor list and the DPA, rather than generalizing here.

ISO/IEC 27001:2022 for information security, certified by Intertek under UKAS accreditation (certificate 0251375, valid to 18 July 2029), and ISO 9001:2015 for quality management, certified by BSI under ANAB accreditation (certificate FS 797863, valid to 23 April 2027). Both certificates are published above. For data protection we are GDPR-aligned, with an EU contracting entity in Eindhoven, and our handling of protected health information is HIPAA-aligned. Scope statements, our Statement of Applicability and the DPA are in the security documentation pack.

Yes — request the pack via the button above and your security team gets what it needs to complete a review without a sales call first. It contains the architecture summary, the ISO/IEC 27001:2022 and ISO 9001:2015 certificates, our Statement of Applicability, the DPA and the sub-processor list. If your organization works from its own questionnaire instead, send it over and our team completes it directly rather than returning a generic response. Anything that is deployment-specific — data residency, for example — we answer in writing rather than leaving it to a general statement.

Tenured transparency specialists — medical writers, data analysts and regulatory reviewers — check every output before it ships, and their sign-off is logged per record. No AI output reaches a health authority without a named human approving it. That is what AI Enabled. Human Driven.™ means in practice: the checkpoint sits in the workflow, not in a policy document. Reviewers are not asked to trust the model either — drafted statements carry the source document and passage they came from, so checking is a read-and-compare rather than a judgment call, and every transformation is logged and attributable to the person who ran it.