Controls built in, not bolted on.
Airlines, insurers, banks and hospital networks put Pazau in front of their customers. Here's how we protect their data, govern our AI and prove it to their auditors.
A policy layer between your customers and every model.
Pazau Guard runs on every conversation, AI or human. It controls what a model can see, what it can say and do, and where your data can go.
- PII redaction before inference. Card numbers, bank details, government IDs and health data are detected and tokenized before any model call, in 30 languages.
- Policy guardrails. Block topics, require disclosures, rewrite unapproved advice and hold legal threats for a human, with every intervention written to the Trace.
- Action limits and approvals. Refund ceilings, per-customer spend caps and approval steps are enforced by the runtime, not by the prompt.
- Regional data residency. US or EU. EU-region conversations are stored in Dublin and processed by models hosted in Frankfurt.
- RedactedCard number (PAN) removed before model call
- BlockedResponse contained unapproved medical advice → rewritten
- RoutedEU customer → processed in eu-west-1 (Dublin)
- ApprovedRefund $480 · approved by CX lead J. Alvarez
- HeldLegal threat detected → handed to human with summary
Independently audited, every year.
Our controls are tested by third-party auditors against the frameworks your procurement and risk teams ask for.
SOC 2 Type II
Security, Availability, Confidentiality
- Audit period
- Apr 1, 2025 – Mar 31, 2026
- Independent CPA firm, report issued May 2026
ISO/IEC 27001:2022
Information security management
- Audit period
- Surveillance audit Nov 2025 · valid to Nov 2027
- Accredited certification body
ISO/IEC 27701:2019
Privacy information management
- Audit period
- Surveillance audit Nov 2025 · valid to Nov 2027
- Accredited certification body
ISO/IEC 42001:2023
AI management system
- Audit period
- Initial certification Jan 2026 · valid to Jan 2029
- Accredited certification body
HIPAA
BAA available on Business and Enterprise
- Audit period
- Third-party assessment Feb 2026
- Independent assessor
GDPR
EU entity, DPO, SCCs, EU data residency
- Audit period
- DPIA reviewed Jul 2026
- Pazau Ireland Limited · DPO Aoife Brennan
CCPA / CPRA
Service provider terms in our DPA
- Audit period
- Annual review Jun 2026
- Internal privacy program
PCI DSS v4.0
SAQ-D for Pazau Voice payments
- Audit period
- Attestation of Compliance Jun 2026
- Qualified Security Assessor
Security documentation, on request.
Audit reports and assessments are shared under NDA. Pick what you need and we'll send a secure link.
Isolated, redundant, and monitored around the clock.
Pazau runs on AWS in two fully separated regions. Production is accessible only through audited, just-in-time access.
Two independent regions
US: us-east-1 with DR in us-west-2. EU: eu-west-1 (Dublin) with DR and AI inference in eu-central-1 (Frankfurt). No shared data plane between them.
Tenant isolation
Per-tenant encryption keys and row-level isolation enforced in the data layer. Cross-tenant access is tested in every release and in every pentest.
Backups and recovery
Continuous point-in-time backups and daily encrypted snapshots in your region. Recovery targets of 1 hour (RPO) and 4 hours (RTO), tested twice a year.
Availability
Multi-AZ deployments with 99.9% (Business) and 99.95% (Enterprise) contractual SLAs. Live and historical uptime is published on our status page.
Secure development
Mandatory code review, SAST and dependency scanning on every change, signed builds and infrastructure as code. There are no manual changes in production.
Detection and response
24/7 monitoring, centralized logs with immutable retention, and an on-call incident response team with runbooks tested in quarterly exercises.
Encrypted everywhere. Your keys, if you want them.
- At rest
- AES-256, with envelope encryption and per-tenant data keys in AWS KMS.
- In transit
- TLS 1.2 or higher, preferring TLS 1.3, with HSTS. Service-to-service traffic is encrypted too.
- Key management
- Keys are rotated automatically every year. Access to KMS is restricted to production services and logged.
- Bring your own key
- Enterprise customers can use customer-managed keys in their own AWS KMS account. Revoke the key and Pazau can no longer read the data.
- Retention
- Configurable per workspace. Traces are retained for 18 months by default, or 30 days to 7 years on Enterprise.
- Deletion
- Export for 30 days after termination, and deletion from production within 90 days.
Your data makes your agent better. It never trains anyone's model.
Neither Pazau nor our model providers train or fine-tune foundation models on your data. It's a contractual commitment.
Model providers process each request and keep nothing. Abuse monitoring logs are disabled under approved exemptions.
Anthropic (Claude, including via Amazon Bedrock in the EU), Azure OpenAI and Google Vertex AI. Each is listed with its region on our sub-processor page.
Approval steps, confidence thresholds and handoff rules are set by you. Every AI decision leaves an exportable Trace.
Least privilege, for your team and ours.
You control who in your organization sees what. We keep our own access to your data narrow, temporary and logged.
SSO and MFA
SAML and OIDC SSO with Okta, Entra ID and Google. MFA is available on every plan and enforceable by admins.
SCIM and roles
SCIM provisioning with role mapping, custom roles, and field-level permissions for sensitive data.
Just-in-time employee access
Pazau staff have no standing access to customer data. Access requires a ticket, approval and hardware-key MFA, and expires automatically.
Audit logs
Every admin action, data export and employee access is logged, retained for 1 year and streamable to your SIEM.
Every vendor that touches your data, listed.
Our sub-processor list names each provider, what it does, what data it processes and where. We give 30 days' notice before adding one, and you have the right to object.
Found a vulnerability? We want to hear about it.
Report it through our HackerOne bug bounty or to security@pazau.com. We offer safe harbor for good-faith research, acknowledge reports within one business day and pay rewards based on severity.
Security questions, answered.
Don't see yours? Email security@pazau.com or ask your account team.
Does Pazau train AI models on our data?+
Where is our data stored?+
How quickly will you notify us of a breach?+
Can we run our own penetration test?+
Do you sign BAAs?+
Will you complete our security questionnaire?+
What happens to our data when we leave?+
Bring your CISO to the demo.
We'll walk your security team through Pazau Guard, data residency and Traces, using your own conversations.