Our approach to security.
RadMah AI is built by engineers who treat security as an engineering discipline, not a marketing exercise. This page documents how the platform is built, the controls in place, and how every one of them is proven.
Security architecture
AES-256 encryption + TLS 1.3
All data at rest is AES-256 encrypted in managed object storage and managed PostgreSQL. All API and inter-service communication runs over TLS 1.3 with HSTS enforced. Database connections are TLS-enforced.
Multi-tenant isolation
Every tenant operates in a logically isolated environment — separate database schemas, object-storage key prefixes, and API-key scoping. Row-level security is enforced at every query.
Write-only secret vault
Connector credentials, OAuth tokens, and API secrets follow a strict write-only pattern. Once written, a secret can only be rotated or deleted — never read back through any API.
Zero-trust API
All API endpoints require authentication. No implicit trust between services. API keys carry granular scoped permissions. Rate limiting, WAF, and DDoS protection on all public surfaces.
Cryptographic evidence chain
Every job produces an evidence bundle sealed with BLAKE3 hashes. Modifying any artefact breaks the seal. The chain is independently verifiable without access to our infrastructure.
Deterministic reproducibility
The same sealed contract, the same seed and the same engine version reproduce byte-identical generated data. The determinism report in each bundle records those inputs. The bundle itself carries per-run identifiers and timing, so it is a per-run integrity commitment rather than a byte-identical artifact.
Security practices
Secure development lifecycle
Code review on every change. Static analysis. Type-safe languages (Python with full type annotations, TypeScript strict mode, Rust for the deterministic core). Strict linter settings.
Dependency management
Automated dependency scanning. SBOM generation for every release. Pinned dependency versions with lock files. Known-vulnerability monitoring via automated auditing.
Fail-closed design
Authentication, authorisation, and rate limiting fail closed. If a security check cannot complete, the request is denied — never silently allowed.
Immutable audit logging
Every API call, job submission, and administrative action is logged with actor identity, timestamp, IP address, and tenant context. Audit logs are append-only and SIEM-ready.
Assurance & compliance status
Exactly where every security and compliance control stands — no borrowed badges.
GDPR data-subject rights
✓ In placeData export and deletion endpoints operational. Data Processing Addendum available on request. Right-to-erasure fulfilled within 72 hours. Privacy reports included in every evidence bundle.
Vulnerability disclosure policy
✓ PublishedPublished with safe harbour. 48-hour acknowledgement commitment.Read the full policy →
SBOM & signed releases
✓ In placeAn SPDX Software Bill of Materials is generated for every release. Release artifacts are cryptographically signed via the CI/CD pipeline.
External penetration test
○ PlannedNo third-party penetration test has been performed. Internal security testing runs continuously through CI security gates. We will publish the date and scope once an engagement is booked. Architecture documentation available under NDA for enterprise evaluations.
SOC 2 Type II
○ PlannedNo certification is held and no audit has been performed. Controls are implemented and continuously tested against mapped SOC 2 control families; the formal audit engagement will follow penetration testing.
Data handling
Encryption at rest
All stored data is encrypted using AES-256. Database volumes, backups and object storage use server-side encryption with provider-managed keys.
Tenant data isolation
Each tenant has isolated storage prefixes, separate API-key scopes, and row-level database security. Cross-tenant access is blocked at the query layer and the storage layer, and both are exercised by isolation gates in CI.
What we store
Account data, job metadata, evidence bundles, generated datasets (encrypted), and audit logs. Synthetic data is produced from statistical distributions — never copies of real records.
Data retention & deletion
Configurable retention periods (30, 90, 365 days). Right-to-erasure requests fulfilled within 72 hours per GDPR Article 17. Deletion events appear in the immutable audit trail.
Deployment options
Managed cloud
Two independent regional planes on Microsoft Azure: European Union and United States. You choose which one your data lives in.
Hybrid SDK
A lightweight SDK on your infrastructure; generation engines run in RadMah's cloud, so job inputs are transmitted to it. Enterprise plan.
Self-hosted / disconnected
Offline container bundle, locally verified licence, local storage. No phone-home and no RadMah cloud dependency at runtime.
Customer security reviews
Enterprise customers can request architecture documentation, security questionnaires (CAIQ, SIG), and technical discussions with our engineering team under NDA.
security@radmah.ai