Security your team
can verify.
Compliance is the architecture, not the afterthought. DEINO ships audit-grade defaults from day one — customer-owned LLM keys, signed audit manifests, sovereign deployment. Inspect the live posture before you ever book a call.
All traffic encrypted with TLS 1.3. HSTS enforced at the edge.
Live security posture · switch domain to inspect controls across Data, Identity, Deployment & Compliance.
Your residency, your cloud.
Four deployment models, one platform. We don’t force our infrastructure on your regulator — choose the topology your compliance team can defend.
Managed SaaS
AWS multi-region — us-east-1, eu-west-1, sa-east-1. Fastest to value, audit-grade defaults from day one. The default for most customers.
Sovereign cloud
GCP EU (europe-west1) or OCI LATAM (São Paulo). Your data residency, your cloud — we don’t force our infrastructure on your regulator.
On-prem Kubernetes
Self-hosted on your own cluster. We ship the manifests; your infra runs them. The audit ledger never leaves your environment.
Air-gapped
Fully offline install with local vLLM — no outbound calls, ever. In production hardening with defense-adjacent partners.
How we protect your data.
Six load-bearing controls — each one a decision the platform refuses to relax. Not a dashboard bolted onto a chatbot.
Customer-owned LLM keys
BYO Anthropic, OpenAI, Mistral, or local LLM keys. We never see them. Encrypted at rest with customer-managed KMS. Switch providers in 48h via the abstraction.
Signed audit manifests
Every manifest cryptographically signed with your key. Tamper-evident. Verifiable years later. The audit trail belongs to you, not us.
Encryption everywhere
TLS 1.3 in transit. AES-256 at rest. Field-level encryption for PII. Customer-managed keys on Enterprise. HSM-backed for Custom Axes.
Append-only audit ledger
Cryptographic signing per write. Optional on-prem ledger so audit history never leaves your environment.
Zero-trust by default
SSO required (SAML / OIDC / Okta / Azure AD). SCIM provisioning. Role-based access control with an explicit matrix — no inheritance.
Reproducible by design
Backtest Forensics reconstructs any past decision, bit-for-bit. The auditor reproduces your rationale on their own infrastructure. No “trust us.”
Where each framework stands.
No aspirational logos. The real status of every framework we map to — live today, in progress, or on the dated roadmap.
| Framework | Status | Detail |
|---|---|---|
| EU AI Act · Annex III | ✓ | High-risk controls implemented; manifest mapped to Annex III |
| BCRA AI principles | ✓ | LATAM Tier-2 bank deployments; sovereign LATAM cloud |
| GDPR · Article 28 | ✓ | Processor terms in standard DPA; 30-day sub-processor notice |
Full transparency.
Our complete sub-processor roster. Customers receive 30-day notice before any addition or change.
| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| Amazon Web Services | Primary cloud infrastructure | All | us-east-1 / eu-west-1 / sa-east-1 |
| Oracle Cloud Infrastructure | Sovereign LATAM deployment | All (LATAM customers) | São Paulo |
| Google Cloud Platform | EU sovereign deployment | All (EU customers) | europe-west1 |
| Cloudflare | Edge CDN, DDoS protection | Public traffic only | Global edge |
| Anthropic / OpenAI / Mistral | LLM providers (BYO keys) | Customer-controlled | Customer choice |
| Pipedrive / Salesforce | CRM | Sales contact data | EU / US |
| Customer.io | Lifecycle email | Email + product event data | US |
| Plausible Analytics | Privacy-friendly web analytics | Anonymized site traffic | EU (Germany) |
| Linear | Product issue tracking | Internal (no customer data) | US |
What you can request.
One email returns the complete documentation set. No NDA required for the first package; your security team reviews on their own timeline.
Report a security issue.
Found a vulnerability in DEINO? Responsible disclosure protects our customers — and we acknowledge contributors publicly.
[email protected] — encrypted via PGP key on request.
Response time
We acknowledge within 24 hours. Triage within 72 hours.
No legal action
We commit not to pursue legal action against good-faith researchers following coordinated disclosure.
Bounty program
Cash rewards for high-severity issues. Public hall-of-fame for all valid reports.
What your security team asks first.
Four answers up front — keys, residency, verifiability, and frameworks.
Who holds the LLM keys?
You do. DEINO is bring-your-own-key for Anthropic, OpenAI, Mistral, or a local model — we never see your keys, and they are encrypted at rest with customer-managed KMS. Inference is billed to you directly by your provider, and you can switch providers through the abstraction.
Where can DEINO be deployed for data residency?
Four models: managed SaaS on AWS multi-region, sovereign cloud in the EU (GCP europe-west1) or LATAM (OCI São Paulo), on-prem Kubernetes on your own cluster, or fully air-gapped with local vLLM. Your residency requirements drive the topology, and the audit ledger can stay inside your environment.
What can an auditor actually verify?
Every output ships an audit manifest cryptographically signed with your key, so it is tamper-evident and verifiable years later. Backtest Forensics reconstructs any past decision bit-for-bit, letting the auditor reproduce your rationale on their own infrastructure rather than taking our word for it.
Which compliance frameworks does DEINO map to?
The platform maps high-risk controls to the EU AI Act Annex III, follows BCRA AI principles for LATAM bank deployments, and ships GDPR Article 28 processor terms in a standard DPA with 30-day sub-processor notice. The Trust page lists live status with no aspirational logos.
The first audit where we handed over a reproducible decision changed the relationship — from defendant to evidence-provider. Six weeks became six hours.
Compliance Officer · LATAM Tier-2 Bank · name confidentialHand it to your security team.
CAIQ Lite, architecture overview, DPA, sub-processor list, incident response, and continuity plan — the full packet, on request. Reviewed on their timeline, not ours.