Security & governance

Security and governance by architecture.

Your infrastructure. Controlled access. Verifiable evidence. The essentials of how AIRA Nexus protects enterprise AI.

Start a security review →Assurance status

Your infrastructure

Run on-premises, in a private cloud or air-gapped. Data stores are self-hosted; cloud models are optional and use your keys.

Identity & isolation

Single sign-on, MFA and server-side access decisions, with tenant isolation enforced in the database.

Policy before every call

Gateway applies approved models, guardrails, data policies and budgets. Approval gates keep people involved in consequential actions.

Evidence you can verify

Runs, approvals and policy decisions are recorded in a hash-chained audit log. Database controls prevent ordinary edits and deletes; verify and export the record for review.

Assurance status

A clear view of our assurance.

Independent penetration testing and SOC 2 are planned; ISO/IEC 27001 is on the roadmap. AIRA Fusion does not currently hold these certifications.

View controls and assurance status
ItemStatusNotes
Non-root containers, pinned base imagesIn placeSecurity baseline checked in CI.
Secret scanning in CIIn placeBlocks committed secrets.
Offline, signed licensingIn placeEd25519 signatures verified locally.
Automated test estateIn placeBackend suites plus end-to-end API and UI tests. Authentication, authorization, tenant isolation and gateway policy changes ship with their tests.
SBOM per imageIn rolloutGeneration exists and is being extended to every release bundle.
Signed delivery bundlesIn developmentPer-customer signed bundles with SBOM, on the release-pipeline roadmap.
Independent penetration testPlannedSummary shareable under NDA once complete. You may run your own test in a pilot.
SOC 2 Type IPlannedTimeline shared in writing on request.
ISO/IEC 27001RoadmapAfter SOC 2.
Formal HA/DR referenceIn progressHA guidance exists in the operator runbooks; a formal document is in preparation.

AIRA helps you produce evidence for SOC 2, ISO/IEC 27001, the EU AI Act, DORA and GDPR. It does not certify your compliance, and AIRA Fusion does not currently hold these certifications.

Risk Committee Check

Four questions your risk committee will ask.

Before any AI goes live, these come up. Answer them for the AI you run today and see where the evidence is thin, and how AIRA Nexus produces it.

  1. 01
    Who can use which model or AI solution?
  2. 02
    What data was sent, transformed or blocked?
  3. 03
    Who approved a consequential action?
  4. 04
    Can we prove what happened, months later?
Security review

Talk through the controls with our engineers.

Request the security overview, share your questionnaire or inspect the controls in a pilot on your infrastructure.

AIRA supplies platform software and security fixes. Your team operates the infrastructure and owns access policies, model selection and backups.

Request a security review →