Encryption and key control
In transit and at rest throughout. Bring-your-own-key is supported, which means a customer can lock us out of their own data unilaterally.
- TLS in transit
- Encrypted at rest
- BYOK supported
Security, compliance & privacy
Trust Centre
Certifications, the security position, subprocessors, and the documents your risk function will ask for.
The position
Your data does not train anything you did not ask for
Customer data is used to serve the customer's own workloads and to train the customer's own models. It is never used to train models for anyone else, it is never pooled across customers, and there is no arrangement under which it could be.
Estates are deployed in the customer's own tenancy by default. Where a customer uses our multi-tenant serving path, workloads are logically isolated, and dedicated or in-tenancy deployment is available for anything that cannot be.
Encryption is applied in transit and at rest throughout. Bring-your-own-key is available on Enterprise and Sovereign tiers, which means we can be locked out of a customer's data by the customer, unilaterally.
The one thing we ask risk functions to look at closely is retention. Trace records are retained to match the underlying business record — often years, not the shorter default that log infrastructure assumes — because that is what makes a decision defensible eighteen months later. Retention periods are configurable and set by the customer.
Certifications
What we hold today: nothing yet
BasinWright holds no third-party security or AI-management certifications at the time of writing. Not ISO/IEC 27001, not ISO/IEC 42001, not SOC 2. An earlier version of this page said otherwise; that was wrong and it has been corrected.
We are telling you this on the page where a risk function looks first, rather than letting it surface in a questionnaire, because the second version costs you a week and costs us the deal.
Where we are. The controls below are implemented and can be evidenced. The formal audit programme is planned rather than complete, and we will not put a date on it here until it is booked — a projected certification date is the same category of claim as a projected certification.
What that means for you. If your procurement process requires a current SOC 2 or ISO 27001 certificate as a gate, we do not pass it today. Say so early and we will not waste your time. If your process allows a control-level review with contractual commitments, that we can do properly, and the Terms and DPA are the place those commitments get written down.
Controls
What is actually implemented
Each of these can be demonstrated in an assessment. None of them is a certification, and we are not presenting them as one.
Tenancy and isolation
Estates deploy into the customer's own tenancy by default. Where a shared serving path is used, workloads are logically isolated and dedicated deployment is available.
- Customer tenancy
- Dedicated endpoints
- Air-gapped option
Access and break-glass
Role-based access with logged administrative actions. Our own access to a customer estate requires customer approval, is time-bound, and is written to the customer's own trace store.
- RBAC
- Customer-approved
- Time-bound
- Logged where you can see it
Training data position
Customer data trains the customer's models and nothing else. It is not pooled across customers and there is no arrangement under which it could be.
- No cross-customer pooling
- No third-party training
Residency enforcement
Routing enforces residency per request from attributes on the request. A route carrying a localisation constraint fails rather than falling back to a non-compliant endpoint.
- Per-request
- Fails closed
Audit trail
Every decision carries its trigger, evidence with record-level lineage, model versions, policy gate and outcome, retained to match the underlying business record.
- Queryable
- Audit pack export
- Customer-set retention
Documents
What your risk function will want
Some of these are public. The rest are available under NDA — ask your named architect, or use the contact form below.
Security questions
The ones we are asked most
Do you train on our data?
We train your models on your data. We do not train anything else on it, we do not pool it with other customers' data, and there is no arrangement under which we could. Where a workload uses a third-party hosted model, that provider's terms are stated on the route and zero-retention terms are used where available.
Where is our data processed?
In the regions you configure. Routing enforces residency per request from attributes on the request, and routes carrying a localisation or sovereignty constraint fail rather than falling back when no compliant endpoint is available. That failure behaviour is the default and is deliberate.
Can you access our estate?
Only through a break-glass path that requires customer approval, is time-bound, and is logged to your own trace store where you can see it. On bring-your-own-key deployments you can revoke our access unilaterally and we cannot restore it.
What happens to our data if we leave?
The artefacts are already yours and already exported continuously — weights, corpora, the entity graph, evaluation suites, pipeline definitions and decision history. On termination the estate keeps running; there is no data to hand back because it was never only in our custody.
How do you handle vulnerabilities?
Coordinated disclosure through security@basinwright.com, with acknowledgement within one business day. Critical vulnerabilities affecting customer estates are notified to affected customers within 24 hours of confirmation, with the mitigation and the timeline.
Do you use subprocessors?
Yes, and the register is public. Changes are notified 30 days in advance, and customers on Enterprise and Sovereign tiers can object. Sovereign estates use no subprocessors outside the host jurisdiction.
Security review
Send us your questionnaire
We complete standard security questionnaires — CAIQ, SIG and most bespoke bank formats — and we would rather do that than have you infer answers from this page.