# Compliance & Security

## **Security & Compliance Framework**

Ensuring the integrity, confidentiality, and availability of data is fundamental to the operation of Autonomy AI. A robust security framework governs all aspects of data handling, access control, and infrastructure management, with adherence to industry best practices and regulatory standards.

* * *

## **Data Security & Isolation**

### **Access Control Mechanisms**

- **Internal Access**: Strictly limited to authorized personnel, enforced through **Single Sign-On (SSO), VPN access, and Two-Factor Authentication (2FA).**
- **Audit Logs**: Continuous logging of authentication attempts, administrative actions, and API usage.

### **Encryption Standards**

- All communication is encrypted in transit, and data is encrypted at rest using **industry-standard protocols**.

* * *

## **Regulatory Compliance & Certifications**

### **GDPR Compliance**

Autonomy AI is actively working toward **full GDPR compliance**. Current measures include:

- **Data Minimization**: Only essential user data (names, email addresses) is collected.
- **Data Protection**: Secure encryption, strict access controls, and adherence to privacy-by-design principles.
- **Data Processing Agreements (DPA)**: Available upon request as compliance processes mature.

### **ISO 27001 & SOC 2 Type 2 Certification**

- AutonomyAI is **SOC2 Compliant** as of June 2025.
- Alignment with **ISO 27001 security management principles**, including access control, risk management, and incident response frameworks.

* * *

## **Data Residency & Storage**

- Customer data is stored in **AWS US**.
- Data residency options are available for **enterprise customers with jurisdictional requirements**.
- **No data is used for AI training**; only **vectorized metadata and descriptive summaries** are retained for searchability.

* * *

## **Incident Management & Monitoring**

### **Threat Detection & Response**

- Using **industry best practices** for intrusion detection, vulnerability management, incident reporting, monitoring, and logs.

### **Incident Response Plan**

- **Notification Protocols**: In the event of a security breach, designated organization contacts are informed in accordance with contractual agreements.
- **Forensics & Recovery**: Incident analysis and remediation follow **industry-standard forensic investigation methodologies**.

* * *

## **AI Security & Governance**

- **Customer data is never used to train AI models**.
- AI-generated outputs are monitored for compliance with **internal security policies and regulatory guidelines**.
- **Strict governance policies** ensure AI operations align with best practices in **data privacy and ethical AI development**.

* * *

## **Sub-Processors & Third-Party Services**

| Provider      | Location | Service Provided                    |
|---------------|----------|------------------------------------|
| AWS           | US       | Cloud Hosting                       |
| OpenAI       | US       | AI Services                         |
| Anthropic    | US       | AI Services                         |
| Datadog      | US       | Monitoring & Analytics              |
| SendGrid     | US       | Email Delivery                      |
| HubSpot      | US       | CRM & Customer Management           |
| Mixpanel     | US       | Monitoring & Analytics              |
| Make         | US       | Workflow Automation                 |
| Langfuse     | US       | Observability & Analytics for LLMs  |
| OpenRouter    | US       | LLM Routing Infrastructure          |

All third-party providers comply with stringent **security and privacy standards**, with contractual agreements enforcing **data protection measures**.

* * *

## **Security-First Development Lifecycle**

Autonomy AI employs **secure-by-design** principles in all development processes, incorporating:

- **Code Reviews & Static Analysis**: Automated and manual security reviews integrated into CI/CD pipelines.
- **Dependency Management**: Regular security assessments of third-party libraries to prevent supply chain vulnerabilities.

* * *

## **Legal & Privacy Policies**

- **Product/service-specific Terms & Conditions** are available upon request.

* * *

## **Future Security Roadmap**

### **Planned Enhancements (2025+)**

- Completion of **SOC 2 Type 2 Certification**.
- Additional **data residency options** for global compliance alignment.
- Formalization of **incident management procedures** to meet evolving regulatory expectations.

* * *

## **Frequently Asked Questions (FAQ)**

Is Autonomy AI fully compliant with GDPR?

Autonomy AI is actively working towards full GDPR compliance. Measures are in place to ensure data security, access control, and regulatory adherence. Data Processing Agreements (DPA) are available upon request.

What security certifications does Autonomy AI have?

Autonomy AI is SOC 2 as of June 2025. The infrastructure aligns with ISO 27001 principles.

Where is customer data stored?

Customer data is stored on AWS US. Data residency options are available for enterprise customers.

How does Autonomy AI handle data access control?

Access is strictly limited based on role-based permissions and **SSO, VPN, and 2FA authentication mechanisms**.

How does Autonomy AI respond to security incidents?

An incident management policy is available upon request.

Is customer data used for AI model training?

No. Autonomy AI does **not** use customer data for AI model training. AI-generated outputs are governed by strict security and compliance policies.

Can Autonomy AI integrate with customer-hosted AI models?

Yes. The platform supports **bring-your-own-license (API key) integration** and self-hosted models.

What sub-processors does Autonomy AI use?

A full list of sub-processors, including AWS, OpenAI, Anthropic, Datadog, SendGrid, and HubSpot, is available in the **Sub-Processors & Third-Party Services** section.