Platform Security & Compliance

PromethistAI is designed with security, compliance, and privacy at its core. This document describes the security principles, operational safeguards, and compliance measures that govern the platform, the distribution channels, and the Relational Intelligence Engine.

Platform Overview

The PromethistAI platform operates as a regionalized, multi-tenant SaaS environment, hosted on Microsoft Azure under an enterprise license. The platform provides account management, project administration, and integration into the Relational Intelligence Engine. All customer instances are logically isolated, and access to administrative functions is restricted to authenticated and authorized users through secure identity providers such as Microsoft and Google.

  • All communication between platform components is encrypted in transit using TLS 1.2 or higher, and all stored information is encrypted at rest using AES-256.

  • Encryption keys are managed by Azure Key Vault and rotated regularly.

  • Access to sensitive operations is further secured by role-based access control and auditable activity logging.

Distribution Channels

Relational agents created and managed on the platform are accessed through client applications running on iOS and Android devices. These applications serve purely as a distribution channel and do not persist sensitive data locally, aside from secure authentication information. All processing continues to occur within the selected deployment region, ensuring both compliance with data residency requirements and reduced latency for end users.

The distribution layer supports kiosk mode and additional controlled pathways while continuing to respect regional boundaries. Regardless of the mode of use, the design ensures that user data remains within the locality selected at the time of account provisioning.

Relational Intelligence Engine

At the core of the solution lies the Relational Intelligence Engine responsible for managing the interaction and data handling with the end user. This component runs within the same Azure regional environment as the platform itself though separated in architectural sense. It processes conversational data securely, using a decoupled microservices architecture with strong inter-service authentication and isolation.

Internal teams at PromethistAI do not have general access to customer conversations; operational access is strictly controlled and allowed only in exceptional circumstances, subject to least-privilege enforcement and audit logging.

Regional Deployment and Data Residency

When creating an account, customers can choose whether their data is deployed and hosted in the European Union or in North America. This regional deployment ensures that data never leaves the selected geography, meeting strict residency requirements. It also provides performance benefits by minimizing latency and ensuring reliable access to relational agents.

The regional choice applies consistently across the platform, the Relational Intelligence Engine, and the distribution channels. As PromethistAI expands, additional hosting regions will be made available, enabling greater flexibility for global organizations.

Identity and Access Management

PromethistAI employs a layered approach to identity and access management (IAM), ensuring that both platform administrators and end users authenticate securely and operate with the least privileges necessary. Our IAM framework governs how accounts are created, how users are authenticated, and how permissions are enforced across the platform and the client applications.

Authentication

By default, PromethistAI supports federated authentication through trusted identity providers such as Google and Microsoft. This eliminates the need for password management and reduces risks associated with weak or reused credentials.

For organizations with more advanced requirements, PromethistAI offers Single Sign-On (SSO) through integration with enterprise identity providers. SSO is powered by Keycloak and supports a wide range of federation standards including SAML 2.0, OpenID Connect, and OAuth 2.0. With SSO enabled, employees, partners, or customers can access the PromethistAI platform and assigned relational agents using the same credentials they use internally, simplifying access and strengthening compliance with enterprise security policies.

SSO is available as part of the Enterprise Tier license, and configuration can be customized per organization in coordination with our technical team.

Authorization and Roles

Authorization within the platform is governed by role-based access control (RBAC). Roles define the scope of actions available to each user and are consistently applied across accounts and projects. By default, the following roles exist at the account level:

  • Owner – Full administrative rights, including billing, member management, and project governance.

  • Editor – Operational control over projects, agents, and assets, without access to sensitive account-level functions such as billing.

  • Viewer – Read-only access for oversight and review purposes.

Within projects, these same roles cascade, ensuring consistent governance across the entire hierarchy. This uniformity reduces complexity while maintaining clear boundaries of responsibility.

Logging and Auditability

PromethistAI maintains baseline operational logs for authentication events, role assignments, and administrative actions. These logs are used internally to support security monitoring and incident response.

For enterprise customers requiring deeper visibility, enhanced audit logging is available on demand. In this mode, detailed records of authentication attempts, role changes, and privileged actions can be exposed to account Owners for compliance and governance purposes.

Client Access and Identities

On the client side, PromethistAI applications for iOS and Android respect the same IAM model. Agents that require authentication enforce identity checks before interaction begins. When SSO is enabled, entitlements flow directly from the enterprise identity provider into the client applications, ensuring that only authorized users can access designated agents.

This design allows organizations to securely distribute agents to employees, partners, or selected customer groups, while maintaining centralized control over who can see and interact with each digital agent.

Operations and Infrastructure

PromethistAI’s infrastructure is deployed exclusively on Microsoft Azure, leveraging Azure’s enterprise-grade compliance with ISO 27001, SOC 2, GDPR, and HIPAA frameworks. All deployments are automated and defined through Infrastructure-as-Code (IaC), ensuring consistency, repeatability, and auditability across environments.

Data Protection and Access Controls

Data protection is embedded into every layer of the platform. All communications are encrypted in transit using TLS 1.2+ and all databases and object storage are encrypted at rest using AES-256. Keys are centrally managed in Azure Key Vault, with strict rotation policies and access logging.

No PromethistAI personnel have routine access to customer conversational content. Limited access is technically possible only for a small, highly secured subset of our operations and DevOps team, and only in exceptional cases such as resolving a customer support request or fulfilling a compliance obligation. Such access is time-bound, governed by least-privilege policies, and fully logged.

Customers do not interact with raw infrastructure data directly. Instead, they may access relevant information through dedicated APIs (for example, APIs exposing memory or account-level resources) or request access through formal support channels. This approach protects the integrity of operational systems while giving customers the transparency they need for governance and compliance – and this feature is available upon request as a part of our Enterprise Tier.

Operational Safeguards

PromethistAI maintains a robust security operations program that includes continuous vulnerability scanning, automated patch management, and 24/7 monitoring across all critical systems. Automated alerting is backed by documented incident response playbooks.

The platform is protected against denial-of-service attacks through Azure Front Door, while regional redundancy ensures that services remain resilient even in the event of localized infrastructure failures.

Business Continuity and Disaster Recovery

PromethistAI is designed for resilience and continuity. Each regional deployment includes redundancy across availability zones, as well as daily encrypted backups. Restoration procedures are regularly tested to validate data integrity and recovery reliability.

The platform’s Recovery Point Objective (RPO) is 24 hours, while the Recovery Time Objective (RTO) for critical services is under four hours. These measures ensure that customer data and services remain available even under adverse conditions.

Compliance and Certifications

PromethistAI is certified under ISO/IEC 27001 (inherited from PromethistAI governing company certifications), demonstrating our commitment to international information security standards. The platform is fully compliant with GDPR, ensuring customer rights such as consent, data portability, and the right to erasure. SOC 2 Type II certification is underway, and HIPAA compliance support is available for customers operating in regulated industries. Regular third-party penetration tests validate the ongoing effectiveness of our security controls.

Privacy & Governance Policy

This section explains how PromethistAI governs data on the platform, how responsibilities are shared with customers, and what rules apply to relational agent behavior. Technical controls (encryption, hosting, IAM, operations) are described in Security & Compliance and are referenced here where relevant.

Purpose and Scope

PromethistAI enables organizations to build and operate relational agents. With that capability comes responsibility for how data is processed and how agents behave. This policy covers data handled within PromethistAI accounts, including platform administration, the Relational Intelligence Engine, and distribution via the PromethistAI iOS/Android clients.

Where this policy references security mechanisms (encryption, monitoring, incident response), the authoritative details live in Security & Compliance.

Roles and Responsibilities under Privacy Law

For Customer Content (e.g., knowledge bases, agent configuration, Memories), the customer is the controller and PromethistAI acts as the processor. For platform operations data (e.g., account admin details, billing, core service telemetry), PromethistAI acts as an independent controller to operate and secure the service.

A Data Processing Addendum (DPA) and the current list of sub-processors are available upon request.

Data Categories We Handle

Customer Content (processor role)

Content you upload or configure (documents, knowledge bases, multimodal assets, MCP metadata), agent configuration (identity, guardrails, processes), and any persisted artifacts produced by the platform (e.g., Memories) or created via your calls to dedicated APIs.

Account & Operational Data (controller role)

Account details (organization, emails, roles), billing/usage data, and minimal service telemetry required to operate, secure, and improve reliability of the platform and mobile clients.

PromethistAI mobile clients act as a distribution layer and do not persist sensitive content locally beyond secure session tokens required for authentication; 3D scenes render on-device.

Data Residency

At onboarding, each account is bound to a hosting region (currently EU or North America). Customer Content is processed and stored exclusively within the selected region. This region binding applies to the administration platform, the Relational Intelligence Engine, and distribution via PromethistAI clients.

Cross-region migration occurs only upon explicit customer request and under a controlled migration plan.

Collection and Use of Data

  • To provide the service. Route and render agent interactions, manage projects/assets, and operate MCP integrations.

  • To secure and maintain the service. Authenticate users, enforce entitlements, detect abuse, and diagnose incidents.

  • To support customers. Investigate issues when you ask us to, or when required for compliance; see “Access by PromethistAI Personnel” below.

We do not sell Customer Content or use it to train unrelated third-party models.

Retention and Deletion

PromethistAI retains conversational interactions and associated artifacts by default. This ensures that relational agents can maintain continuity across sessions, support compliance and audit requirements, and provide customers with the ability to review historical data where needed.

All stored content is:

  • Encrypted at rest using AES-256 and contained within the region selected at onboarding (e.g., EU or North America).

  • Protected by strict access controls, with access limited to a highly secured subset of PromethistAI operations staff, and only under approved, time-bound, and logged conditions (such as a customer support request or compliance requirement).

Customers may request data exports or deletions through formal support channels. When such requests are processed:

  • Active systems are updated immediately.

  • Backups are purged according to PromethistAI’s standard backup lifecycle, ensuring compliance while preserving system integrity.

Unless otherwise agreed in writing, retention follows PromethistAI’s default platform policy. This model ensures data availability for operational continuity and compliance, while giving customers governance rights over export and deletion on demand.

Access by PromethistAI Personnel

PromethistAI personnel do not have routine access to Customer Content. Access is technically possible only for a highly secured subset of our Operations and DevOps team, and only under specific circumstances such as incident response, compliance requirements, or when a customer explicitly requests support. All such access is time-bound, requires prior approval, follows least-privilege principles, and is fully logged.

No other PromethistAI teams have access to Customer Content by default. In cases where a customer explicitly grants access — for example, by inviting PromethistAI staff into a dedicated account or project for implementation, testing, or support purposes — access is limited to the scope defined by the customer and governed by the same security controls.

Customer Access to Data and Audit Information

Customers do not access raw infrastructure storage or logs. You interact with your own data through available platform interfaces. Where audit information is exposed, it is provided in a structured, customer-safe form. Additional audit extracts can be provided upon request, subject to security review.

Shared Responsibility & Customer Controls

PromethistAI provides the secure, compliant foundation; customers decide how it is used.

You control:

  • Region selection at account creation (applies platform-wide, including engine and distribution).

  • Identity and access: choosing Google, Microsoft, or enterprise SSO; assigning roles and entitlements within accounts and projects.

  • Agent configuration: knowledge bases, multimodal assets, MCP integrations, guardrails, and the agent’s purpose/process.

  • Retention and deletion of persisted artifacts via formal requests.

  • User notices/consents where your organization is the controller (e.g., informing end users they are interacting with an automated system).

PromethistAI controls:

  • Hosting security, encryption, regional processing, secure operations, vetted sub-processors, monitoring and incident response, and execution of controller instructions consistent with the DPA.

Agent Content Responsibility

Relational agents are configured and governed by the customer. PromethistAI does not pre-moderate or continuously monitor agent behavior.

You (the customer) are solely responsible for:

  • The content and responses your agents produce, including accuracy, legality, and appropriateness.

  • Ensuring agent behavior complies with applicable laws, regulations, industry rules, and your internal policies.

  • Implementing and maintaining guardrails to prevent unlawful, offensive, discriminatory, or otherwise prohibited output.

  • Obtaining any required consents or notices from end users.

PromethistAI provides technical controls and may suspend or restrict access where we detect abuse or violations of platform policies, but responsibility for agent output rests with the customer.

Data Subject Rights (GDPR and analogs)

When you are the controller, PromethistAI (as processor) will assist you in fulfilling data subject requests—access, rectification, deletion, portability, objection, and restriction—through available APIs and formal support channels. Requests sent directly to PromethistAI that relate to your Customer Content are routed to you as the controller.