---
title: "Security"
description: "Amass is hosted in EU regions with tenant isolation, SSO and role-based access. Customer data never trains models. ISO 27001 and SOC 2 Type II are in progress."
url: https://amass.tech/security
---

# Security

Security

# Your data stays private, and it stays yours.

You work in a regulated environment and need to know where your data goes. Amass keeps each customer’s index separate, hosts it in EU regions and never trains models on your data.

EU hostingEnterprise cloud infrastructure

Infrastructure

## Cloud infrastructure hosted in EU regions

The Amass stack is hosted on enterprise cloud infrastructure in EU regions.

### Managed Kubernetes

Container orchestration with provider SLAs, private networking and automatic failover.

### Model providers under contract

Our third-party model providers are contractually barred from retaining or training on your data. Enterprise data processing terms apply by default.

### Hardware-backed secrets + managed PostgreSQL

Secrets in hardware-backed key storage, and a managed relational database encrypted at rest and in transit.

Single-tenant and bring-your-own-cloud deployments are available if you need stricter isolation.

Data privacy

## Your queries never touch a training pipeline.

Customer data (queries, documents, results and outputs) is never used to train, fine-tune or improve AI models, ours or those of the third-party providers we use. The commitment is written into our contracts.

Retrieval and generation are separate. Private data is retrieved from your authorized index and used only inside the isolated context of that request. It never feeds public web search, cross-customer learning or model training.

-   Tenant isolation: your data index is never co-mingled with other customers
-   No public indexing: your documents are never surfaced to other users or search engines
-   Right to deletion: request log deletion at any time
-   Usage logs: for operational monitoring only, never analytics or training

Access control

## Identity and permissions through your IdP

Amass connects to your identity provider and enforces role-based access per workspace and per tenant.

### SSO

SAML, OIDC, SCIM via Microsoft Entra ID or your IdP

### RBAC

Role-based access control per workspace

### MFA

Multi-factor authentication required on every account

### Just-in-time provisioning

Users are provisioned and deprovisioned automatically

### Per-tenant isolation

No cross-tenant data access

Certifications & compliance

## Controls in place, certifications in progress.

Your security team can review our controls, architecture and policies now, without waiting for a certificate.

### ISO 27001

~6 months

Controls fully mapped. Formal certification in progress (est. ~6 months). Right-to-audit provisions available now.

### SOC 2 Type II

~12 months

Controls fully mapped. Formal certification in progress (est. ~12 months). Security questionnaires answered under NDA.

### NIS2-aligned

Active

Governance and incident response aligned to NIS2 requirements. EU-hosted infrastructure supports national regulatory requirements.

If your infosec team needs more detail, we share architecture documentation, security questionnaires and right-to-audit provisions under NDA.

[Request security documentation](mailto:support@amass.tech)

Infrastructure partners

## Enterprise terms with every provider

Every third-party infrastructure provider works under a data processing agreement.

-   Microsoft Azure
-   Azure OpenAI
-   Azure Kubernetes Service
-   Azure Key Vault

## Have questions about security?

We answer infosec questionnaires and walk your security team through the architecture, controls and policies.

[Talk to us →](mailto:support@amass.tech)[Book a security review →](mailto:support@amass.tech?subject=Security%20Review%20Request)

Data

No training on your data

Hosting

EU-hosted, enterprise

Isolation

Tenant-isolated by architecture

Certification

ISO 27001, SOC 2, NIS2: in motion