Security and Compliance
Built for industrial buyers in regulated environments.
Deployment posture
The product is built to run on customer hardware, and its architecture is designed for fully air-gapped sites with no outbound network calls. Customer operational data stays at the customer site. Development never uses raw production data from customer systems: builds rely on structured and synthetic prompts.
Data handling
Append-only event log architecture provides immutability and complete audit trail. State is derived, never edited directly. All access is governed by role-based permissions with full audit logging. Backup and recovery follow customer-defined retention policies. Data residency stays at the customer site.
Standards
- ISO 27001 design principles for information security management.
- GDPR compliance for European data handling.
- NIS2 alignment for critical infrastructure cybersecurity in the European Union.
- Industry-specific regulations supported per customer (environmental compliance, occupational safety, banking, healthcare).
Current posture
We are pre-SOC 2. Our architecture and operating practices follow SOC 2 design principles, and we will pursue formal certification once revenue scale justifies the audit cost. For customers requiring SOC 2 today, we provide our security controls documentation under NDA.
Let's see if your operation fits.
Need our security controls documentation, or have a question about deployment in a regulated site? Ask us directly.
Or email us directly at admir.malaj@weorchestrate.tech.