# Your data. Your boundary. Your terms · Security · Dscvry > Your data, your boundary, your terms: residency, encryption, retention, access control, local inference and compliance posture across every deployment mode. Source: https://dscvryai.com/security/ # Your data. Your boundary. Your terms. From managed cloud to fully air-gapped. Nothing leaves unless you say so. Independently assured. SOC 2 Type II ISO/IEC 27001 EU GDPR Penetration tested ## Security is the architecture. When intelligence systems work on contracts, financial records, production data, compliance evidence or source code, the boundary, the residency and the access controls aren't layers added later. They're the foundation. ### Your data stays inside. Every deployment mode keeps source data, outputs and inference inside the environment you control. ### Inference where you require. Models run on your infrastructure. No calls to third-party model providers unless you configure them. ### It shows what it did. Audit trails, processing logs and evidence lineage are built into every workflow. ## The data boundary. Where your data lives, how it moves and which controls govern it, in every deployment mode. Data residency Residency controls Source data, outputs and model weights stay inside your environment. Source documents, extracted data, model weights, inference outputs and processing logs remain inside the deployment environment you specify. Nothing is sent to Dscvry-operated infrastructure, third-party analytics or external model providers unless you explicitly configure an integration. Geo-fenced storage, an on-premise data plane, local model weights and no cloud egress are standard in private and air-gapped deployments. Data in transit Transport security TLS 1.3 with mutual authentication between services. All data in transit is encrypted with TLS 1.3. Service-to-service traffic uses mutual TLS with certificate pinning. In air-gapped deployments there is no transit to secure; in on-premise and VPC deployments all traffic stays inside your network perimeter. Data at rest Storage encryption AES-256, with customer-managed keys. Source documents, extracted records, model artefacts, processing logs and configuration are encrypted at rest with AES-256. Customer-managed keys are supported in cloud and on-premise deployments; you control the key lifecycle, rotation and revocation. Retention & deletion Data lifecycle Retention set by you. Your data is never used to train models for anyone else. Retention and purge rules are set by your organisation and agreed for each deployment. Your data is never used to train or fine-tune models outside your deployment. Access control Identity & access RBAC, SSO, audit logging and no standing Dscvry access. Role-based access controls govern who configures workflows, accesses data, reviews outputs and manages the deployment. SSO via SAML 2.0, audit logging of every access event and least privilege are standard. Dscvry engineers have no standing access to customer environments; support access is granted only with your explicit authorisation, scoped, time-limited and logged. ## Inference inside your boundary. Model execution, reasoning and output generation happen on the infrastructure you control. In air-gapped and edge deployments the system runs with full functionality and no internet connection. - ### Local models. Specialised models deploy directly to your infrastructure; core operations need no external calls. - ### Offline capable. Full functionality without connectivity in air-gapped and edge deployments. - ### Model provenance. Every output records which model version produced it. ## Compliance posture. Independently audited and certified. Reports and certificates are available under NDA to customers and prospective customers. SOC 2 Type II Trust service criteria Independently audited: security, availability and confidentiality. An independent CPA firm has issued a SOC 2 Type II report on the design and operating effectiveness of our controls for the security, availability and confidentiality trust service criteria. The report is available under NDA. ISO/IEC 27001:2022 Information security Certified information security management system. Our information security management system is certified to ISO/IEC 27001:2022. The scope covers Structurify, forward-deployed engineering in client environments, the underlying cloud infrastructure, and our UK and India operations. GDPR & data protection Data protection Independently assessed against the EU GDPR. An independent assessment against the EU General Data Protection Regulation was completed in 2026. Data processing agreements, data minimisation, purpose limitation and lawful-basis documentation are standard, and data protection impact assessments are available for regulated deployments. Penetration testing Security testing Tested by an independent third party every year. Our platform is penetration-tested annually by an independent third party. An executive summary of the latest results is available under NDA. ## Review. Agree. Deploy. Security requirements are settled at the start of every deployment, not discovered after the system is built. - ### Architecture and threat review. Deployment architecture, data flows, access controls and the threat model walked through with your security and infrastructure teams before anything is built. - ### Controls and documentation. Data handling terms, processing agreements, controls, incident response and audit access agreed and written into the deployment plan. - ### Verified deployment. Deployed with the agreed controls from day one. Penetration testing and vulnerability assessment are available as part of the engagement. ## Bring us the work where wrong is expensive. Start with the operational problem. We’ll work out the data, models and agents it needs, and where it should run. [Talk to us →](https://dscvryai.com/contact/) **London**Discovery AI Limited · United Kingdom **Hyderabad**ReDscvry Technology Private Limited · India **Chennai**ReDscvry Technology Private Limited · India