Passing the Security Review

The DPO, CISO, or compliance lead gatekeeping adoption needs the product's properties stated in review vocabulary; the champion needs evidence they can forward. This page maps the deployment facts documented across these guides onto the frameworks reviewers actually assess against, and closes with the standard questionnaire lines answered.

1Facts, not certifications#

Everything on this page is a deployment fact: a property of the software as it runs on your infrastructure, documented in a linked guide and verifiable on your own installation. No certification is claimed for the software itself, and nothing here is legal advice; these are the facts your assessment maps onto your framework. That framing is not a hedge, it is the point: because the software runs entirely inside your environment, the controls that matter are your environment's controls plus the ones documented here, and both are yours to verify rather than take on trust.

2The fact everything follows from#

Inference happens on your hardware. Models, prompts, documents, embeddings, search indexes, and memory all live and execute on the machine you operate (Where Data Lives is the complete inventory, store by store, with lifetimes and deletion paths). The vendor never receives, stores, or processes your content: there is no usage phoning home, no license ping carrying content, and no background upload. A default install behind a deny-all outbound firewall serves everything local without a single blocked connection, because nothing tries to leave (Air-Gapped Deployment is the recipe, and also the cheapest verification a reviewer can run).

Most questionnaire lines collapse against this one fact. Data residency is the machine's location. The subprocessor list for the inference path is empty. Cross-border transfer analysis for inference is short: no transfer occurs.

3What can leave the machine#

Overstating "zero egress" burns trust with any reviewer who runs a packet capture, so state the exact boundary instead. By default, nothing leaves. Bytes leave only through five opt-in channels (model downloads, web-reaching tools under the egress policy, attached MCP connectors, telemetry export, and the SSO exchange with your identity provider), each explicitly configured, each individually controllable, and each pointed at a destination the operator chose, never at the vendor. There is no sixth channel; the channel-by-channel inventory that a review cites is Where Data Lives, section 3.

4GDPR: residency and the processor question#

• The processor question. A processor is a party that processes personal data on the controller's behalf. Here, the vendor supplies software; your organization runs it and processes its own data on its own infrastructure. No personal data flows to the vendor in operation, which is the fact your DPO's Article 28 analysis starts from when deciding whether any data processing agreement is even in scope for the inference path.
• Residency and transfers. Data resides where the machine resides. The inference path creates no cross-border transfer to analyze.
• Erasure and retention. Every store has a stated lifetime and a named deletion path: uploads sweep themselves after a configurable retention (30 minutes by default), memory facts delete individually, search tenants and collections delete through the API, and the full disposal runbook is mechanical (Where Data Lives, section 4).
• Records of processing. The same inventory page is written to be lifted into a records-of- processing entry: what is stored, where, for how long, and how it is deleted.
• Security of processing. The technical measures are the security model: network posture, authenticated callers, least-privilege grants, isolation, and audit.

5HIPAA: the PHI posture#

For a covered entity or business associate evaluating local inference: PHI submitted to this server is processed on your infrastructure and transmitted to no outside party, so the question of a business associate relationship with the software vendor over inference traffic does not arise from the data flow; there is no such traffic. The Security Rule's technical safeguard categories map onto shipped controls your assessment can verify:

• Access control: per-key authentication with least-privilege grants and a read-only scope (Keys and Authentication), operator sign-in through your identity provider (Single Sign-On).
• Audit controls: every API call recorded and attributed to its credential, every operator change noted in the activity log (Observability).
• Transmission security: HTTPS out of the box, publicly trusted certificates via ACME, and an HTTPS-only option for the admin surface (Going Live).
• What remains yours: physical safeguards, workstation policy, host disk encryption, and workforce controls are the deployment environment's obligations, exactly as for any on-premises system.

6SOC 2 and ISO 27001: where the controls live#

The software carries no SOC 2 report or ISO 27001 certificate of its own, and one would answer the wrong question: those attest an operating organization, and the organization operating this system is yours. The useful mapping is which shipped mechanisms your own control set can point at. The map, control area by control area:

7The EU AI Act: the deployer's position#

The AI Act assigns obligations by role. An organization running models on its own infrastructure to power its own systems is, in the Act's vocabulary, typically a deployer of those systems; the obligations that attach to model providers sit with the parties who publish the models, and which weights you adopt is your decision (Licensing covers what rides each model). What the deployment facts contribute to a deployer's file:

• Record-keeping: the attributed request trail and logs are the operational record, with bounded capture so the record does not itself become a data store to protect.
• Oversight and control: which tools a model may use and what it may reach are operator policy, never model discretion (Tools and Egress).
• Data governance: the inventory and deletion paths above.

Classifying your use cases under the Act is your counsel's work; these are the facts that work builds on.

8The questionnaire, answered#

The standard vendor-assessment lines, each answered with a deployment fact and the guide that proves it:

For the reviewer who asks "what can go wrong" rather than "what is controlled", the adversary- oriented companion is The Threat Model.

9Stated plainly#

• Every claim here is a deployment fact a reviewer can verify on the installation itself; no certification is claimed and none is needed to check them.
• The vendor never processes your content: inference, storage, and deletion all happen on hardware you operate.
• Exactly five egress channels exist, all opt-in, all pointed at destinations you choose; a default install sends nothing anywhere.
• The controls reviewers ask about (access, isolation, audit, retention, transport security) each have a shipped mechanism and a guide that documents it.