AI you can account for.
To your DPO, your CISO, your regulator and your customers. Your data stays yours, access follows the permissions in the source, and every step can be read back.
Four things that always apply
Your data stays yours
We do not train models on your data. You choose where the platform runs, and every customer has its own isolated stack.
Permissions follow the source
Anyone who may not see a document in the source system does not get it through AI either. Permissions travel with each document and are enforced on every search.
Guardrails
Every call passes prompt injection detection and a check that the answer is grounded in sources. We switch on masking of personal data (PII) where your use case calls for it.
Auditable
Every run is an immutable log of what the agent saw, decided and did. With traces and replay you can read back every step.
Frameworks and certificates
Two certificates or recognitions, and four frameworks we work within. We make that distinction on purpose.
- ISO 27001Certified
- Gradient, the company behind soev.ai, is ISO 27001 certified. That is the international standard for information security.
- Haven+Compliant
- The platform is Kubernetes-native and Haven+ compliant. That is why it can move without being rebuilt.
- GDPRFramework
- We never train on your data, sign a data processing agreement and do the DPIA together with your DPO.
- BIO2Framework
- We do the BIO quick scan together with your CISO. We set up access, logging and data location to match what the BIO asks.
- NIS2Framework
- An isolated stack per customer and a log of every step support the requirements NIS2 places on your supply chain.
- EU AI ActFramework
- Human oversight (human-in-the-loop), logging of every run and source citations with every answer are built in.
Where your data lives is your choice
The choice also determines which law your data falls under.
Four places where soev.ai can run: a Dutch cloud at one of our cloud partners, a European cloud, your own cloud or on-premise on your own servers.
- Dutch cloudWith a Dutch cloud partner.
- Your data stays in the Netherlands, with a Dutch company. That puts it outside the reach of the US Cloud Act.
- EU cloudIn a European cloud.
- Your data stays within the EU.
- Your own cloudIn your own cloud environment.
- Your own agreements and security stay in force. Which law your data falls under depends on your cloud provider.
- On-premiseOn your own servers.
- Your data does not leave your own data centre.
Every customer has its own isolated stack. Moving is possible without rebuilding.
Security in layers
Network
An isolated stack per customer, and encrypted traffic between all components.
Data
Encryption at rest and in transit, with encrypted backups.
Access
Sign-in through your own SSO, with roles and permissions per user.
Monitoring
Traces, replay and alerts. You see what happens, down to the energy per call.
Guardrails on every call
Before a question reaches the model and before an answer reaches the user, it passes the guardrails that are switched on for your use case. At a risky step the agent pauses and a person decides.
- Prompt injection detection.
- Optional: masking of personal data (PII).
- Grounding check: every answer backed by sources.
- Human-in-the-loop: pause, review, resume.
A question containing a name and a citizen service number. PII masking is switched on here: the personal data is masked before the question reaches the model. Below it three checks: no prompt injection found, two items of personal data masked, and the answer is backed by sources. The step is recorded in the log.
The log of one agent run as a timeline: question received, sources searched, proposal drafted, paused for human approval, approved, carried out and recorded.
Every step can be read back
Every run is an immutable log of what the agent saw, decided and did. So afterwards you can show how an answer or a decision came about.
- Immutable log per run.
- Traces and replay of every step.
- Source citations down to the passage.
What you get from us
For your own accountability, internally and towards your regulator.
- The DPIA, together with your DPO.
- The BIO quick scan, together with your CISO.
- A data processing agreement with the contract.
- Gradient's ISO 27001 certificate.
- A log of every run, for your own audits.
Building on soev.ai?
Then you need to be able to show it to your customers and their regulator too.
- It runs in a Dutch or European cloud, or in your customer's cloud.
- Never trained on customer data.
- An audit log of the kind your customer's regulator asks for.
- Every agent tested on real data, with a benchmark you can show.
Frequently asked questions
Can we meet the GDPR with soev.ai?
Soev.ai is built to work within the GDPR. We never train on your data, you choose where your data lives, we sign a data processing agreement and we do the DPIA together with your DPO.
Is soev.ai ISO 27001 certified?
Gradient, the company behind soev.ai, is ISO 27001 certified. That is the international standard for information security.
What about the BIO?
The BIO is the Dutch government security baseline. We do the BIO quick scan together with your CISO, and set up access, logging and data location to match what it asks.
And the EU AI Act?
What the EU AI Act asks of AI systems is in the platform: human oversight, logging of every run and source citations. Which requirements apply to your use case, we determine together.
Where is our data?
Wherever you want: in your own cloud, with a Dutch or European cloud partner, or on-premise in your own data centre. Every customer has its own isolated stack.
Do you train models on our data?
No. Your data is only used to give answers within your own environment.
Want to go through this with your DPO or CISO?
How a first call goes
- [01]You tell us what you are running into
Which systems, which data and which rules.
- [02]We show how it works for others
With the measurements to go with it.
- [03]Together we decide what phase 1 can be
One use case, with a benchmark as the yardstick.
45 minutes · online or on site · no obligation