Trust & Security
Information security
& Privacy
SoterAI is committed to protecting the confidentiality, integrity, and availability of customer information through enterprise-grade security practices.
Our Security Commitment
Enterprise security,
SoterAI maintains a comprehensive information security program that implements administrative, technical, and physical safeguards to reasonably and appropriately ensure the confidentiality, integrity, and availability of customer information and intellectual property.
We understand that technology and risk evolve over time. Therefore, we engage qualified third-parties to conduct annual risk assessments and continually evaluate, modify, and adjust our security procedures, policies, and standards to ensure alignment with our documented compliance processes.
SoterAI has designated a security team responsible for guiding all security strategy, policy development, enforcement, training, and maintaining a security-minded culture. This team is also responsible for our incident response process and procedures.
We have designated a Data Protection Officer who is responsible for all data privacy matters, oversight, and governance. Our privacy policy defines our continuous commitment to upholding privacy to the utmost importance.
As part of our third-party vendor management program, we validate our vendors and subprocessors to ensure they meet or exceed our strict data privacy and compliance standards. View our current list of authorized subprocessors.
Security Pillars
Six layers of
Our information security program is built on industry best practices and frameworks including SOC 2, GDPR, CCPA, and HIPAA requirements.
SOC 2 Type II Certified
We maintain SOC 2 Type II certification, demonstrating our commitment to security, availability, processing integrity, confidentiality, and privacy.
How it works
Annual third-party audit by independent assessors verifying our controls against the Trust Services Criteria.
Enterprise-Grade Encryption
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption. Encryption keys are managed securely with strict access controls.
How it works
Zero-knowledge key management — customer data keys are isolated per tenant and rotated on a defined schedule.
Regulatory Compliance
Our security program is designed to comply with GDPR, CCPA/CPRA, LGPD, PIPEDA, UK GDPR, and the EU AI Act requirements.
How it works
Dedicated Data Protection Officer oversees all privacy governance, including international data transfer mechanisms.
Access Controls
Multi-factor authentication (MFA), role-based access controls (RBAC), and regular access reviews ensure only authorized personnel access customer data.
How it works
Principle of least privilege enforced across all systems. Privileged access requires just-in-time approval.
Infrastructure Security
Our infrastructure is hosted on SOC 2 compliant cloud providers with 24/7 monitoring, automated threat detection, and disaster recovery capabilities.
How it works
Multi-region redundancy with defined RTO/RPO targets. All infrastructure changes go through peer-reviewed deployment pipelines.
Continuous Monitoring
We conduct regular security assessments, vulnerability scanning, and penetration testing to identify and remediate security risks proactively.
How it works
SIEM with 24/7 alert triage. Critical vulnerabilities patched within 24 hours of disclosure.
Regulatory Compliance
Compliance Frameworks
SoterAI's security program is designed to comply with major data protection regulations worldwide.
Security Practices
How we protect
We implement comprehensive security practices to protect your data at every level.
AI & Data Protection
AI-Specific Data
As an AI-powered platform, SoterAI implements additional safeguards specific to AI and machine learning systems:
Zero-Data Retention: Customer prompts and data are not retained after processing by our LLM providers.
No Model Training: Customer data is never used for training or improving AI models.
EU AI Act Compliance: We comply with Regulation (EU) 2024/1689 requirements for AI systems.
LLM Provider Oversight: Regular audits of our LLM providers to ensure compliance with data protection obligations.
Transparency: Clear documentation of AI processing activities and data flows.
Documentation
Security Resources
Access our security documentation and policies.
Security Questions?
If you have questions about our security practices or need additional documentation for your compliance requirements, please contact our security team.