Home / Security & Trust
Security & trustYour data never leaves your perimeter.
AANCER runs on your own infrastructure, inside your network. There is no AANCER endpoint your data passes through, and no telemetry call home. When a message is too sensitive for a cloud model, the platform refuses the call rather than trusting a checkbox.
Written for the frameworks regulators cite.
Air-gapped, no-call-home deployment satisfies data-localisation requirements across the EU, MENA and APAC. It maps directly to the regimes your auditors already know.
GDPR
Art. 17 / 22 / 30Records-of-processing export and typed-confirmation erasure ship in the product. Neither one breaks a litigation hold.
NIS2
EU DirectiveDefault-deny egress and an isolated security-event stream address the resilience and incident-reporting duties directly. Logging is superuser-proof.
ISO 27001
In progressIndependent penetration test and certification pipeline under way. On-prem deployment exempts AANCER from most cloud schemes entirely.
EU AI Act
Art. 12 / 14Per-call evidence records and human-approval gates. A workflow can wait up to 30 days for a decision without timing out.
Sovereignty enforced in the code path.
- Per-message classification. Every message is Sovereign, Internal or Permitted. A message marked sovereign cannot reach a cloud model, because the platform returns a 403 SOVEREIGNTY_BLOCK instead of making the call.
- Per-workspace policy. Finance and Legal can run local-only while Sales uses governed cloud, and a local-only workspace is verified sovereign rather than taken on trust.
- An SSRF block no operator can switch off. Internal ranges, loopback and link-local are refused at the infrastructure layer, so a hijacked prompt cannot reach inside your network.
- Default-deny connector egress. Each connector declares where it may talk, and every other destination is refused and audited.
- A dataExitedPerimeter flag on every audit event. Export it as a structured report and show a regulator exactly what stayed inside.
Injection defense that starts with structure.
- Two independent gates. Untrusted content is delimited, provenance-tagged and role-downgraded before any detector runs. A separate action gate vets every tool, connector and sub-agent call, so even a perfect injection cannot act.
- An ML scanning layer on GPU. The structural floor runs on every install. On a GPU deployment, the LLM-Guard sidecar adds a machine-learning injection score on top of it, and on CPU-only installs the structural defense runs alone.
- Secret detection with a hard block. Paste an API key and you get HTTP 422 before any model call, and the secret itself is never logged.
- PII redaction. Data is sanitized in place, and the model still returns a useful answer.
- Topic and toxicity filters. Admins edit them, and changes take effect on save.
- Groundedness flagging. RAG answers your sources do not support arrive marked for review.
- Live status lights. Green is computed from real runtime state, not hard-coded.
Files, models and roles, all checked.
Sovereignty keeps your data in. These controls check what comes in, harden the model boundary, and limit what each person can do once they are inside.
On-prem malware scanning
Every file uploaded to knowledge or a workflow is scanned by a malware engine (ClamAV) running inside your perimeter before it is stored or used. Infected files are rejected, and scanning is on by default.
ML-based LLM guard
Structural injection defense runs on every install. Add a GPU and the LLM-Guard sidecar brings a machine-learning injection score, plus secret, PII and toxicity detection that run before and after each model call.
Role-based access control
People see and do only what their role allows. Navigation and actions are persona-scoped across admin, editor and user seats, with custom roles in the Professional and Enterprise editions.
An audit log your DBA cannot rewrite unseen.
Every action is logged automatically into an append-only ledger protected at the database layer. There is no configuration step and no opt-out.
Superuser-proof
Database triggers block UPDATE, DELETE and TRUNCATE on the ledger, even for a database superuser. Disabling the triggers is itself logged, which holds up in a regulatory investigation.
Article-12 evidence per call
Every AI request records who ran it, the classification, the routing decision, tokens, latency and outcome. The record is auto-generated and exportable for auditors.
Security events, separated
Blocked prompts, failed logins, certificate revocations and egress blocks live in their own stream, isolated from operational noise.
Where each guarantee is enforced.
These are the layers that enforce each guarantee, not the policy language that describes it. Every control fails closed and writes to the same append-only ledger.
| Control | Enforced at | Behaviour when triggered |
|---|---|---|
| Sovereignty routing | Request path | Sovereign-classified message at a cloud tier returns 403 SOVEREIGNTY_BLOCK, and no cloud call is made. |
| SSRF / egress block | Infrastructure | Internal ranges, loopback and link-local refused; cannot be disabled by an operator. |
| Connector egress | Network policy | Default-deny, so undeclared destinations are refused and audited. |
| Structural injection defense | Prompt assembly | Untrusted content delimited, provenance-tagged, role-downgraded before any detector runs. |
| Independent action gate | Tool invocation | Every tool, connector and sub-agent call is vetted separately. Without a valid passport it does not execute. |
| Secret detection | Pre-model | HTTP 422 before any model call; the secret is never logged anywhere. |
| Malware scanning | File upload | Uploaded files scanned by an on-prem ClamAV engine before storage; infected files rejected. On by default. |
| ML injection scanning | Model boundary (GPU) | Structural defense on every install; the LLM-Guard sidecar adds a machine-learning score on a GPU deployment. |
| Role-based access | Application layer | Persona-scoped navigation and actions; custom roles in Professional and Enterprise. |
| Credential encryption | At rest | Connection secrets encrypted with AES-GCM, held by the gateway; never exposed to a workflow author. |
| Signed agent passports | Per-install CA | Budgets and ceilings issued by your own CA; revocation is immediate and logged. |
| Append-only audit ledger | Database triggers | UPDATE / DELETE / TRUNCATE blocked, even for a superuser. Trigger changes are themselves logged. |
| Legal hold & retention | Server-side | Fail-closed hold blocks erasure; per-class retention enforced by the platform, not by promises. |
> from prompt to provable processing record.
Bring your security team.
The best AANCER demos are the ones where the CISO asks the hard questions. Bring them, and we will run the same controls this page describes on your own stack, live, on your own data.