Trust & Security
Information security
& Privacy
SoterAI is committed to protecting the confidentiality, integrity, and availability of customer information through enterprise-grade security practices.
Our Security Commitment
Enterprise security,
SoterAI maintains a comprehensive information security program that implements administrative, technical, and physical safeguards to reasonably and appropriately ensure the confidentiality, integrity, and availability of customer information and intellectual property.
We understand that technology and risk evolve over time. Therefore, we engage qualified third-parties to conduct annual risk assessments and continually evaluate, modify, and adjust our security procedures, policies, and standards to ensure alignment with our documented compliance processes.
SoterAI has designated a security team responsible for guiding all security strategy, policy development, enforcement, training, and maintaining a security-minded culture. This team is also responsible for our incident response process and procedures.
We have designated a Data Protection Officer who is responsible for all data privacy matters, oversight, and governance. Our privacy policy defines our continuous commitment to upholding privacy to the utmost importance.
As part of our third-party vendor management program, we validate our vendors and subprocessors to ensure they meet or exceed our strict data privacy and compliance standards. View our current list of authorized subprocessors.
Security Pillars
Six layers of
Our information security program is built on industry best practices and frameworks including SOC 2, GDPR, CCPA, and HIPAA requirements.
SOC 2 Type II Audited
Our SOC 2 Type II report covers four Trust Services Criteria: security, availability, confidentiality, and privacy.
How it works
Annual third-party audit by independent assessors verifying our controls against the Trust Services Criteria.
Enterprise-Grade Encryption
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption. Encryption keys are managed securely with strict access controls.
How it works
Encryption at rest covers databases, backups, and temporary files. Integration credentials are envelope-encrypted with AWS KMS.
Regulatory Compliance
Our security program is designed to comply with GDPR, CCPA/CPRA, LGPD, PIPEDA, and UK GDPR.
How it works
Dedicated Data Protection Officer oversees all privacy governance, including international data transfer mechanisms.
Access Controls
Multi-factor authentication (MFA), role-based access controls (RBAC), and regular access reviews ensure only authorized personnel access customer data.
How it works
Principle of least privilege enforced across all systems. Administrators use separate privileged accounts, and access is reviewed every quarter.
Infrastructure Security
Our infrastructure is hosted on SOC 2 audited cloud providers with continuous monitoring, automated threat detection, and disaster recovery capabilities.
How it works
Hosted across multiple AWS availability zones, with daily encrypted backups that are tested every year. Every code change is peer-reviewed before release.
Continuous Monitoring
We conduct regular security assessments, vulnerability scanning, and penetration testing to identify and remediate security risks proactively.
How it works
Centralized logging and AWS GuardDuty threat detection, with alerts reviewed by our team. Vulnerabilities are fixed in order of severity.
Regulatory Compliance
Compliance Frameworks
SoterAI's security program is designed to comply with major data protection regulations worldwide.
Security Practices
How we protect
We implement comprehensive security practices to protect your data at every level.
AI & Data Protection
AI-Specific Data
As an AI-powered platform, SoterAI implements additional safeguards specific to AI and machine learning systems:
Zero-Data Retention: Our LLM providers, Azure OpenAI and Google Vertex AI, are configured for zero data retention and do not keep customer prompts or outputs after processing.
No Model Training: Customer data is never used for training or improving AI models.
EU AI Act: SoterAI is designed with the EU AI Act (Regulation (EU) 2024/1689) in mind, and we are transparent with users when they interact with AI.
LLM Provider Oversight: Our LLM providers go through our vendor management process, including a review of their SOC 2 reports, and are bound by data processing agreements.
Transparency: Clear documentation of AI processing activities and data flows.
Documentation
Security Resources
Access our security documentation and policies.
Security Questions?
If you have questions about our security practices or need additional documentation for your compliance requirements, please contact our security team.