We hold our own platform to the standard we hold yours to. Local-first by default, audited continuously, and red-teamed by the same team that finds vulnerabilities in everyone else's AI. Here's exactly how your data is handled.
We don't ask for trust — we provide the documentation. Every certification below is independently audited and available under NDA.
Independently audited controls across security, availability, processing integrity, confidentiality, and privacy. Report refreshed annually.
Certified information security management system covering the full platform, infrastructure, and organizational controls.
Full data-subject rights support, EU data residency option, DPA available, and a named Data Protection Officer.
BAA available for healthcare deployments. PHI handling, encryption, and access controls meet the HIPAA Security Rule.
The AI management system standard. Certification underway — the natural home for an AI security company. Expected Q3 2026.
California consumer privacy rights fully supported, including data access, deletion, and opt-out of sale (we never sell data).
Unlike cloud-first AI platforms, CHLOE is local-first by design. The default deployment never sends your data anywhere.
The complete list of subprocessors for our cloud offering. On-prem and air-gapped deployments use none of these — your data never reaches a third party.
| Subprocessor | Purpose | Data Region | On-Prem Mode |
|---|---|---|---|
| AWS | Cloud infrastructure (cloud tier only) | US / EU selectable | Not used |
| Cloudflare | CDN, DDoS protection, WAF | Global edge | Not used |
| Stripe | Billing & payments | US | Billing only |
| Postmark | Transactional email | US | Not used |
| Your LLM provider | Optional — only if you enable a hosted model | Your choice | Local models |
↳ Air-gapped deployments operate with zero subprocessors. All models run locally; no external calls are made at runtime.
Public documents download instantly. Gated documents require a signed NDA — request access and we'll turn it around within one business day.
Send us your vendor questionnaire, your DPA, your toughest architecture questions. We answer fast, and we answer completely.
Contact Security & Compliance