Security & trust SOC 2: not yet audited

Security & trust. What is true today.

Archipath is built for firms that handle sensitive client data. Here is what the platform does today, and what it does not claim.

How your data flows

A dedicated instance is the expectation. Cloud isolation is not automatic.

Hosting, operator access, model providers, and outbound integrations are documented for each deployment. Customer-cloud containment is not assumed.

Dedicated instance. This release expects a dedicated routing instance and independent storage for each company. The software does not create cloud isolation by itself. Customer-cloud deployment is assessed separately.
Your model providers, your keys. Prompts go to the providers you choose (Anthropic, OpenAI, Google, AWS Bedrock) under your own API keys and contracts. Archipath is not a reseller.
In most cases, names, phone numbers, email addresses, Social Security numbers, and card and account numbers are masked before your company's prompts reach the AI provider.
No training on your data. Prompts are sent only through provider APIs whose business terms prohibit training on your data.
Approval before action. Any write to a connected system (for example Microsoft 365) needs explicit user approval, and every read and write is logged.

Controls in place

What the application does.

These statements describe the application in this repository. They are not a certification, and they do not describe every customer deployment.

Encryption. Connector tokens are encrypted at rest with AES-256-GCM. Transport uses TLS, and the application sends HSTS on HTTPS responses.
Security headers. The application sets Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy on responses that pass through its security middleware.
Tenant separation. Tenant data is separated at the application layer, with context containers for client-level separation. That is not the same as cloud-account isolation.
Sign-in. TOTP two-factor authentication is supported. SSO uses OIDC. LDAP sign-in does not by itself establish MFA.
Audit records. New audit records have local integrity checks. Independent checkpoint storage is required for stronger guarantees.
Automated tests. Automated test suites run in CI on every change, covering routing, connectors, and security controls.

Frameworks

Mapped. Not audited.

An internal control map relates implemented controls to NIST SP 800-53 and the SOC 2 Trust Services Criteria. SOC 2: not yet audited. The map is not a certification and is not a completed security questionnaire.

Helps you organize evidence for frameworks such as the EU AI Act, NIST AI RMF, and ISO/IEC 42001. Archipath does not claim to be compliant with those frameworks.

During evaluation

What we will discuss.

A walkthrough can cover the architecture and the controls on this page. This page does not publish a completed security questionnaire, a sub-processor list, or a data processing agreement.

Report a security issue

Email info@kyro22.com.

Use info@kyro22.com. A separate security mailbox is not confirmed, and this page does not promise a response time.

Talk through the controls.

A security-focused walkthrough covers deployment boundaries, redaction, approvals, and the audit record. Bring the questionnaire you actually use.

Book a security-focused walkthrough →