Our security commitment

Security is not a feature we add. It is the reason this product exists. Every request proxied through the gateway is cryptographically attested before it executes. This page documents the controls we apply to our own infrastructure.

Verify receipts without trusting Aqta

Every enforcement decision is signed with a published Ed25519 key. The receipt format is an open specification and independent verifier libraries are available in Python and TypeScript. Your auditor verifies signatures locally. Nothing ever round-trips through our servers.

Open specification

ATTESTATION-v1

Canonical JSON + Ed25519, licensed CC-BY-4.0

Published public key

gUoUhIvptKAoLTnry3VrDtOQEWggGQveLrHFVrfNqmE

Base64url, 32-byte Ed25519 public key

# Pythonon PyPI ↗

pip install aqta-verify-receipt

from aqta_verify_receipt import verify_receipt

verify_receipt(receipt).valid # → True

# TypeScript / Nodeon npm ↗

npm install aqta-verify-receipt

import { verifyReceipt } from 'aqta-verify-receipt'

verifyReceipt(receipt).valid // → true

1. Data architecture

We do not store prompt content or model responses. The gateway inspects requests in transit to enforce configured policies (PHI detection, loop detection, spend limits) and immediately discards the content. Only metadata is retained.

No prompts stored, ever
No model responses stored, ever
Metadata retained: timestamps, model names, token counts, policy outcomes, costs
Audit records: SHA-256 hash-chained, tamper-evident
ZK proofs: cryptographic compliance attestations without exposing content

2. Encryption

TLS 1.3 for all traffic in transit
AES-256 for data at rest
Ed25519 digital signatures on every inference receipt
SHA-256 hash chaining for audit log integrity
Schnorr ZK proofs (live); Groth16 SNARK circuits (in development)

3. Infrastructure

Hosted in EU (Ireland), GDPR jurisdiction
PostgreSQL on Cloud SQL with encrypted storage
Redis rate-limiting with Lua atomicity (no race conditions)
Permanent blocks expire after 24h, no indefinite NAT lockouts
Fail-closed rate limiting by default when cache is unavailable
Per-tenant isolation: all keys scoped to organisation ID

4. Authentication & access

OAuth 2.0 (Google, Microsoft, Auth0/SSO) with provider ID verification
OTP via email, no passwords stored
Cross-tenant data access impossible by design (org-scoped queries)
API keys hashed at rest, never logged in plaintext
SSO available on Enterprise tier

5. Compliance coverage

EU AI Act (Arts. 9-15): article tagging and PDF audit export shipped, ready for August 2026 mandate
GDPR: EU-hosted, data minimisation, zero PII stored
HIPAA: PHI detection and no-storage architecture (Health pack)
ISO/IEC 42001: designed in alignment with the framework; formal mapping on the roadmap
NIST AI RMF: risk-mapping language used throughout; formal mapping on the roadmap
NIS2 / DORA / MiFID II / SR 11-7: on request for Enterprise and Sovereign design partners

Compliance status

Framework	Scope	Status
EU AI Act Arts. 9–15	All tiers	Aligned
GDPR	All tiers	Aligned
HIPAA	Health pack	Aligned
ISO/IEC 42001	All tiers	Roadmap
NIST AI RMF	All tiers	Roadmap
SOC 2 Type II	All tiers	In progress
ISO 27001	All tiers	Planned
NIS2 / DORA / MiFID II / SR 11-7	Enterprise & Sovereign	On request

6. Vulnerability disclosure

We welcome responsible disclosure of security vulnerabilities. If you believe you have found a security issue, please contact us before disclosing publicly so we can investigate and remediate.

Contact: security@aqta.ai

7. Contact

For security inquiries: security@aqta.ai
Aqta Technologies Ltd., Dublin, Ireland