AI Governance & Security Platform

Security, compliance and data practices you can verify.

Certifications, security architecture and the data policies behind them.

Certified by TÜV NORD

ISO/IEC 27001:2022

Certificate no. 44 121 26822312 · Since 27 Jul 2026

Aligned by design

EU AI Act

Governance built into the platform, not bolted on

Aligned by design

GDPR

EU data residency · your data never trains our models

ISO/IEC 27001:2022 is an independent third-party certification, audited by TÜV NORD. EU AI Act and GDPR readiness reflects internal design and assessment efforts and does not constitute certification, regulatory approval, or a guarantee of legal compliance.

01

Compliance & certifications

What's certified by an independent third party, what's inherited from our cloud infrastructure, and what we build to satisfy by design.

Request the ISO 27001 certificate
Standard / framework Scope Status
ISO/IEC 27001:2022 Information security management system Certified by TÜV NORD · Certificate no. 44 121 26822312 · Valid from 27 July 2026
ISO/IEC 27017 Cloud-service security controls Inherited from underlying cloud infrastructure (AWS)
ISO/IEC 27018 Protection of personal data (PII) in the cloud Inherited from underlying cloud infrastructure (AWS)
EU AI Act Risk-based governance of AI systems Aligned by design
GDPR & UK GDPR Protection of personal data of EU data subjects Aligned by design
02

Security architecture

How the platform is built to keep your data and your team's AI use contained, inspected and recoverable.

Firewall

Zero-trust inspection of every prompt, file and connector action, outbound and inbound, before it reaches a model or leaves the workspace.

Policies cover PII, financial data, credentials, health data and toxic content.

Matches can be alerted on, blocked or masked.

Encryption & tenant isolation

Data is encrypted in transit via TLS/SSL.

Workspaces are logically isolated per department, project or client.

Role-based access: Owner, Administrator, Contributor, User, and an Auditor who can view but not change anything.

Log

Multiple log types capture who used AI, on what, and what the policies caught.

Logs are downloadable by administrators.

Supports ISO 27001, GDPR and EU AI Act audit and traceability requirements.

Data Vault

Every interaction — compliant or not — is written to an immutable record for the duration of your engagement.

Evidence can't be edited or deleted by users or admins after the fact.

See Privacy & Data for what happens when an engagement ends.

03

Sub-processors

Third parties that process data on our behalf, what they do, and where. This list is incorporated by reference into our Data Processing Agreement (DPA).

Foundation model providers

6
Sub-processor
Amazon Web Services, Inc. (Amazon Bedrock)
Google LLC (Vertex AI)
OpenAI, L.L.C.
Perplexity AI, Inc.
X.AI LLC
National Center for High-performance Computing (NCHC)

Infrastructure

2
Sub-processor
Amazon Web Services, Inc.
Google LLC / Google Cloud EMEA Limited

Application services

6
Sub-processor
Stripe, LLC
Sampark Inc. (d/b/a Composio)
Zapier, Inc.
AlphaAI Technologies Inc. (Tavily)
Slack Technologies Limited / Slack Technologies, LLC
Botpress Inc.

Public website & marketing

4

Used on anyinsight.ai only — do not process customer content within the platform.

Sub-processor
Shopify Commerce Singapore Pte. Ltd.
Google LLC
Meta Platforms, Inc.
Klaviyo, Inc.

Last updated 20 Oct 2026 · Reviewed at least annually and whenever a sub-processor is added or replaced. Covers transfers of Customer Personal Data under both the EU GDPR and the UK GDPR; transfer-basis detail for each entry is set out in the DPA. Questions: customer_support@anyinsight.ai

04

Privacy & data handling

What we do with your data, how long we keep it, and the rights you have over it.

Read the full Privacy Policy

How AnyInsight.ai handles your data

Your data is never used to train our models.

Data submitted through the platform (uploads, AI-generated content, connector activity) is retained in the Data Vault for the duration of your contract, immutable and not deletable by users or admins, to preserve audit integrity.

When your contract ends, your data can be deleted on request — retention during the engagement does not conflict with your right to erasure afterward. Where no contract specifies a period, AI interaction data defaults to 90-day retention before secure deletion.

EU customer data is hosted on AWS in Frankfurt, Germany (eu-central-1).

Your rights under GDPR

We support all GDPR data subject rights — access, rectification, erasure, restriction, objection and portability. Full detail is in Section 11 of the Privacy Policy linked above.

To exercise any of these rights, contact us:

customer_support@anyinsight.ai
05

Documents & FAQ

Supporting documents, including certifications and our security whitepaper, are available upon request.

Is customer data used to train your models?

Data is encrypted in transit via TLS/SSL.
How is data encrypted?

Data is encrypted in transit via TLS/SSL.
Can we delete our data after we leave?

Yes. Data Vault records are immutable for the duration of your engagement; on termination, data can be deleted on request.
Do you support SSO?

Yes — SSO (e.g., Microsoft Entra ID) and MFA are supported.
Are you GDPR compliant?

Compliant by design. EU customer data is hosted on AWS in Frankfurt, Germany (eu-central-1), and a DPA is available on request.
How does AnyInsight.ai address the EU AI Act?

AnyInsight.ai is aligned by design with the Act's transparency, human-oversight and record-keeping requirements.
What cloud provider do you run on?

AWS, as a multi-tenant, multi-region SaaS. AWS itself is certified to ISO/IEC 27001, 27017 and 27018.