Trust Center
Controls, SLAs, andaudit history.
Our live compliance posture, written SLA commitments, and recent external assessments — built for the regulated industries we serve. Updated within 30 days of any material change. Detailed reports available to qualifying clients under NDA.
Where we stand on the frameworks that matter.
SOC 2 Type II
Audit in progressOur SOC 2 Type II audit is currently underway with an independent third-party CPA firm. The audit covers the Trust Services Criteria: Security, Availability, and Confidentiality. Expected completion Q3 2026. Existing customers may request a copy of our interim controls narrative at any time.
HIPAA BAA
Available nowA Business Associate Agreement is available for every client that transmits, stores, or processes PHI through managed services or AiT products, executed at contract time. A white-glove BAA with legal review is included on Professional and Enterprise Hosted Agents tiers.
GDPR-Ready
Controls in placeData handling, sub-processor agreements, and DPAs are aligned to GDPR. EU-resident personal data is handled under Standard Contractual Clauses. We maintain a current sub-processor list and provide DPAs on request.
ISO 27001
2027 roadmapISO 27001 certification is on our 2027 roadmap. Current practices are aligned to Annex A controls, and formal ISMS documentation is in development. Enterprise clients who require ISO 27001 today may request our current ISMS evidence pack.
What we commit to, in writing.
Incorporated into every service agreement. SLA credits apply to Professional and Enterprise tiers per the MSA.
| Commitment | Target | Scope | Measured |
|---|---|---|---|
| Platform uptime | 99.9% | AiT Hosted Agents, AiTLLM, AiTBMS, AiTCRM | Rolling 30-day calendar month |
| API p95 response latency | <200 ms | REST endpoints (non-LLM inference calls) | Rolling 7-day window |
| Critical incident response | <4 hours | P1 incidents; escalation path defined in SOW | First detection to initial response |
| Infrastructure monitoring | 24/7 | All managed and AiT product infrastructure | Continuous — no maintenance windows |
| Helpdesk first response | 2 minutes | Managed IT clients, phone and chat | Business hours; 24/7 for P1 |
The five most recent external assessments.
- Apr 2026External penetration testThird-party offensive security firmNo critical findings
- Mar 2026SOC 2 Type II audit (in progress)Independent CPA firm, observation period activeIn progress
- Jan 2026HIPAA risk assessmentAnnual Security Rule compliance reviewPassed
- Nov 2025Dependency vulnerability scanAutomated SBOM and dependency audit across all AiT product repos0 critical CVEs
- Oct 2025Infrastructure uptime reviewAnnual review of GCP uptime, incident response, SLA adherence99.97% uptime
Security practices
How we run our own house.
- Zero Trust internally. Conditional Access, phishing-resistant MFA, device compliance gates, and least-privilege admin on every tenant we touch.
- Full audit trail. Every automated action is logged, attributable, and exportable. No black boxes — Helix and Ops ship evidence with every change.
- Sandboxed change. Patches and remediations validate in a sandbox, check compatibility, and deploy off-peak. Rollback is a button.
- US-based senior engineers. 100% of client escalations are handled by US-based senior staff — background-checked, certified, named.
Next step
Questions about our security posture?
Our compliance team answers questionnaires, provides evidence packs, and walks you through controls. No slide deck — direct answers.