Trust Center
AI that operates within your rules.
Everything an institution needs to evaluate Edrak in one place: how agents inherit your permissions, where data lives, what is logged, which frameworks apply and how to reach the people accountable for them.Everything an institution needs to evaluate Edrak in one place: how agents inherit your permissions, where data lives, what is logged, which frameworks apply and who is accountable.
Permissions
Evaluated per retrieval
Agents see what the person they work for may see
Residency
Jurisdiction you designate
Data and inference stay inside the boundary
Audit
Immutable, exportable
What ran, under whose authority, on which evidence
Human controls
Approval lines you define
Missions pause at the line and resume on decision
Security runs through the architecture.Security runs through the architecture
The same controls apply to every person, every agent and every action, on every deployment. Each area has its own page.
01
Security overview
Encryption in transit and at rest on every deployment shape. Enterprise sign-in, authorization, revocation and audit across documents, search, workflows and connected tools.Encryption in transit and at rest. Enterprise sign-in, authorization, revocation and audit across documents, search, workflows and tools.
Read the overview →02
Permissions & masking
Access is evaluated per retrieval, never cached into an answer. Sensitive fields are masked before inference, per data class. Write access is scoped per workflow and granted explicitly.Access evaluated per retrieval, never cached into an answer. Sensitive fields masked before inference.
How permissions work →03
Data residency
Data and inference run in the jurisdiction you designate. Model routing respects residency and classification before fit, cost or speed. Managed cloud, in-region and sovereign or air-gapped deployment per engagement.Data and inference in the jurisdiction you designate. Managed, in-region and sovereign or air-gapped deployment.
Deployment options →04
Auditability
An immutable log holds every read, draft, decision and write-back with its authority, evidence and author. Exportable to your SIEM. Any line in any output traces to its source.An immutable log of every read, draft, decision and write-back, with authority, evidence and author. Exportable to your SIEM.
See the audit model →05
Human controls
You define what AI does alone and what waits for approval. Missions pause at those lines and resume the moment the owner decides. Nothing is written to a system of record outside its authority.You define what AI does alone and what waits for approval. Missions pause at those lines.
Choose what AI can do →06
Responsible AI
Grounded answers with citations, honest when the evidence is not there, budgets and limits per workflow so runaway loops stop at the boundary. Curated models, admitted through evaluation.Grounded answers with citations, honest when evidence is missing, budgets that stop runaway loops.
Our principles →
Frameworks and regulation
Documentation available under NDA during enterprise evaluation
ISO/IEC 27001
Information security management system covering people, process and platform, with the control set mapped to how Foundry and Atlas handle customer data.Information security management mapped to how Foundry and Atlas handle customer data.
Read the ISO 27001 page →PDPL
Residency, masking, retention and data-subject handling designed to meet the Personal Data Protection Law, with in-Kingdom hosting available.Residency, masking, retention and data-subject handling designed to meet the law, with in-Kingdom hosting available.
Read the PDPL page →GDPR
Lawful basis, processor obligations, data-subject rights and international transfer handling for customers operating in or with the European Union.Processor obligations, data-subject rights and transfer handling for EU customers.
Request the DPA →Sector and national rules
Financial, government and critical-infrastructure requirements are addressed per engagement, including cybersecurity control frameworks mandated by national regulators.Financial, government and critical-infrastructure requirements addressed per engagement.
Discuss your requirement →
Diligence, supported.Diligence, supported
Security questionnaires, architecture reviews and documentation requests are handled during enterprise evaluation. Request access and a named contact responds.
Request access- Security overview and architecturePublic
- Data processing agreementOn request
- Sub-processor and model-provider listOn request
- Penetration test summaryUnder NDA
- Business continuity and recoveryUnder NDA
- Security questionnaire responsesUnder NDA
Model providers
Policy decides what each model may touch; routing decides which one gets the task
In-region API
Frontier and efficient models reached through in-region endpoints. Each carries a data-classification ceiling set by your policy; anything above it never reaches the provider.
- Mistral
- xAI
Inside your boundary
Open-weight models running on your infrastructure, for restricted data that must never leave it. Required for sovereign and air-gapped deployments.
- DeepSeek
- Mistral
Open-weight models on your infrastructure, for restricted data that never leaves it.
Report a vulnerability
Found something? Write to security@edrak.com. We acknowledge within two business days and keep you informed to resolution.. Acknowledged within two business days.
Privacy requests
Data-subject and processing questions go to privacy@edrak.com. See the Privacy policy for what we collect and why.
Compliance team
Questionnaires, audits and documentation: compliance@edrak.com. A named contact owns each request.