Security & Compliance

Built for the audit your regulators run.

SOC 2 Type II. Chunk-level RBAC. Audit trail per agent decision. Encryption at rest and in transit. Five layers of defense, every workload.

SOC 2 Type II CASA Tier 2
The four pillars

What your security team signs off on.

Not a checkbox list. Each pillar is a real implementation backed by independent audit.

01 · Compliance

SOC 2 Type II, continuously audited.

Independent attestation refreshed annually. Continuous monitoring of controls, not point-in-time snapshots.

SOC 2 Type II CASA Tier 2
02 · Identity & access

Chunk-level RBAC, inherited from source.

Every agent retrieval enforces the user's permissions on every chunk of every document, not just at the document level.

SAML / OIDC SSO SCIM provisioning Inherited RBAC MFA enforced
03 · Encryption

At rest. In transit. Bring your own keys.

AES-256 at rest, TLS 1.3 in transit. Customer-managed encryption keys (CMK) supported via AWS KMS, Azure Key Vault, GCP KMS.

AES-256 at rest TLS 1.3 in transit CMK / BYOK
04 · Audit trail

Every agent decision, fully traceable.

Action-level logging. Cited retrievals. Reasoning chains preserved. Auditors don't accept "the AI said so", and Dataworkz never asks them to.

Per-decision log Citation graph Reasoning preserved Tamper-evident
Defense in depth

Five layers. Every workload.

Scroll through the perimeter. Each layer secures a different surface; together they answer your auditor's questions.

01 · Network

Perimeter your infosec team controls.

VPC peering and PrivateLink keep traffic off the public internet. WAF rules tunable per tenant. IP allowlisting for admin endpoints. Network segmentation between control plane and data plane.

  • VPC peering
  • PrivateLink
  • WAF
  • IP allowlist
02 · Identity

SSO, SCIM, and chunk-level RBAC.

SAML and OIDC SSO with major IdPs (Okta, Azure AD, Google Workspace, Ping). SCIM provisioning keeps user state in sync. RBAC inherited from source systems flows down to every chunk of every retrieval.

  • SAML / OIDC
  • SCIM provisioning
  • MFA enforced
  • Inherited RBAC
03 · Data

Encrypted at rest. BYOK on every tier.

AES-256 at rest with customer-managed keys via AWS KMS, Azure Key Vault, or GCP KMS. TLS 1.3 in transit. Chunk-level access control enforced by the retrieval engine, RBAC isn't an afterthought, it's the gate.

  • AES-256
  • TLS 1.3
  • BYOK / CMK
  • Chunk-level RBAC
04 · Model

BYO LLM. Air-gapped if needed.

Bring your own model, OpenAI, Anthropic, or self-hosted. In-VPC deployments support air-gapped inference: prompts and completions never leave your perimeter. Per-agent model isolation prevents cross-tenant data bleed.

  • BYO LLM
  • Self-hosted models
  • Air-gapped inference
  • No cross-tenant context
05 · Audit

Every decision, cited and traceable.

Per-agent audit log captures every retrieval, every reasoning step, every tool call, every output. Tamper-evident hash chain. Exportable to your SIEM. Auditors get the paper trail; security teams get the alerts.

  • Per-decision log
  • Citation graph
  • Tamper-evident
  • SIEM export
01
Network perimeter
VPC · WAF · IP allowlist
02
Identity & access
SSO · SCIM · RBAC
03
Data encryption
AES-256 · TLS · BYOK
04
Model isolation
BYO LLM · air-gapped
05
Audit trail
cited · tamper-evident
Audit-ready by default

Every agent decision cited, logged, and traceable.

Continuous SOC 2 Type II compliance. CASA Tier 2 assessed for sensitive OAuth scopes. Vendor due-diligence packet available on request.

SOC 2 Type II CASA Tier 2
Request audit packet Deployment options
Vendor due diligence

What your security team will ask.

No. Customer data is never used to train Dataworkz models. When you bring your own LLM, we recommend a model provider with the same commitment (most major providers offer enterprise contracts with no-training guarantees).
Every chunk indexed by the retrieval engine carries a permission set inherited from the source document. At query time, the requesting user's permissions are matched against each candidate chunk before retrieval. A user cannot retrieve a chunk they cannot read at source, even if it's semantically relevant to their query.
Yes. Customer-managed encryption keys (CMK) are supported on Dedicated and In-VPC tiers via AWS KMS, Azure Key Vault, or GCP KMS. Managed SaaS uses Dataworkz-managed keys with optional envelope encryption.
Every agent run logs: input prompt, retrieved chunks (with source IDs), model invocations (with model + version), tool calls (with arguments + responses), reasoning steps (when reasoning agent is used), final output, and the user identity making the request. Logs are tamper-evident and exportable to your SIEM.
Input sanitization at the retrieval boundary, output validation against agent contracts, tool-call allowlisting per agent, rate limiting per user and per agent, and continuous red-team testing against the OWASP LLM Top 10. Prompt injection vulnerabilities are a known risk surface; we treat them as we would any other input-validation concern.
SOC 2 Type II report and our standard vendor due-diligence questionnaire are available under NDA. Reach out via the contact form and we'll send the packet the same business day.
Get the packet

Bring your security questionnaire.
We'll fill it in.

SOC 2 Type II report, vendor DDQ, encryption keys policy, incident response plan, sub-processor list, all available under NDA, same business day.

Request the packet Deployment options