Trust Center

Everything a regulator would ask us, answered in public.

Raidu is the thing your auditors will use to verify your AI. So we hold ourselves to the same bar. This page is the source of truth. It updates when we do.

SOC 2 Type II ISO/IEC 27001 certified HIPAA compliant GDPR compliant
Records
Tamper-evident
hash-chained, write-once
Retention
10 years
write-once
Assessed
SOC 2 Type II and ISO/IEC 27001
HIPAA and GDPR compliant
Deployment
Your cloud account
AWS, GCP or Kubernetes
Assurance

Four assessments, control by control.

45 CFR §§ 160, 162, 164

HIPAA

Compliant (independent assessment, 4 Sep 2026)
ArticleRequirementStatusRaidu control
§164.308 Administrative safeguards covered RBAC and least-privilege access
§164.310 Physical safeguards covered Inherited data-center controls; evidenced in the SOC 2 Type II report
§164.312 Technical safeguards covered TLS 1.3 in flight · AES-256 + envelope at rest
§164.316 Documentation (6y retention) covered 10y WORM default, 6y configurable minimum
§164.502(b) Minimum necessary covered Connector-scoped PHI masking (Checkpoint 03)
§164.514 De-identification covered Safe Harbor method; masking replaces identifiers with typed placeholders
TSP 100 · 2017 (rev.)

SOC 2 Type II

Security, Availability and Confidentiality criteria, under NDA
ArticleRequirementStatusRaidu control
CC1 Control environment covered Code of conduct, background checks, yearly training
CC6 Logical & physical access covered SSO-only · MFA enforced · just-in-time admin
CC7 System operations covered Documented runbooks
CC8 Change management covered Management-approved changes; SDLC policy; tested in non-production before deployment
A1 Availability covered Runs in your cloud, on your availability setup
C1 Confidentiality covered Least-privilege · customer data tenant-isolated
Information security management system

ISO/IEC 27001:2022

Certified by INTERCERT for the ISMS of the Tower platform and supporting cloud infrastructure; surveillance valid to 31 Aug 2027
ArticleRequirementStatusRaidu control
Cl. 6 Planning covered Risk assessment and treatment plan, reviewed annually
Cl. 7 Support covered Security awareness training on hire and annually
Cl. 8 Operation covered Change control, supplier review, secure development
Cl. 9 Performance evaluation covered Internal audit programme + management review
A.5 Organisational controls covered Documented policy set approved by the CEO
A.8 Technological controls covered Encryption, logging, access control, hardening baselines
Regulation (EU) 2016/679

GDPR

Compliant (independent assessment, 4 Sep 2026) · DPA and SCCs available
ArticleRequirementStatusRaidu control
Art. 5 Principles of processing covered Purpose-bound per policy, logged per execution
Art. 17 Right to erasure covered Tenant-scoped erasure, with a receipt on record
Art. 25 Data protection by design covered PII masking default · opt-out requires sign-off
Art. 30 Records of processing covered Execution records serve as RoPA
Art. 32 Security of processing covered Encryption, pseudonymization, resiliency tests
Art. 35 DPIA covered DPIA template bundled with onboarding
What a record looks like

A record an auditor can open, verify, and trust.

Every decision is written to an append-only, hash-chained record: the rule that applied, the policy version, what happened. Change one entry and the chain shows where. Not logs in a bucket.

allow entry 7 of 7,412 · write-once
Recordrec_01JBVX7P9A8Z8PTQJG4K9NDJ4W Modelanthropic/claude-sonnet-4-5 Started14 Oct 2026, 14:02 UTC Decision allow Chain valid
Raw JSON ›
{
  "schema":     "raidu.record/v2",
  "record_id":  "rec_01JBVX7P9A8Z8PTQJG4K9NDJ4W",
  "tenant":     "acme-corp",
  "agent":      "support-triage-v3",
  "model":      "anthropic/claude-sonnet-4-5",
  "started_at": "2026-10-14T14:02:11.041Z",
  "checkpoints": [
    { "ck":"01", "name":"user_input",
      "entities": ["EMAIL_1","SSN_1","CREDIT_CARD_1"] },
    { "ck":"02", "name":"before_llm",
      "masked": 3, "policy":"enterprise.v17" },
    { "ck":"03", "name":"before_tool",
      "tool":"gmail.send", "outbound_pii":"scoped" },
    { "ck":"04", "name":"after_tool",
      "new_entities": 0 },
    { "ck":"05", "name":"agent_response",
      "final_scan":"clean" }
  ],
  "policies":   ["hipaa.phi-redact", "eu-ai-act.art10+13", "no-card-to-llm"],
  "decision":   "allow",
  "explanation":"PII masked before model. Tool call scoped. Response clean. No policy violations.",
  "prev_hash":  "b7f3...c421",
  "hash":       "e9a2...d3fa",
  "chain":      "valid"
}
Security

The controls behind the runtime.

Cryptography
  • ● AES-256-GCM at rest, envelope keys
  • ● TLS 1.3 in flight, mTLS between services
  • ● Hash-chained WORM, tamper-evident
Access & Identity
  • ● SSO-only (SAML / OIDC)
  • ● MFA enforced, WebAuthn supported
  • ● Just-in-time admin with approver
  • ● Regular access reviews
  • ● Tenant-scoped IAM, no cross-tenant reads
Operations
  • ● Dedicated install in your own cloud
  • ● CloudFormation, Terraform or Helm on any Kubernetes
  • ● Write-once records, 10-year retention
Data handling
  • ● No training on customer data
  • ● Data stays in the region of your own cloud account
  • ● Tenant isolation enforced at the database
  • ● Right-to-erasure, with a receipt on record
  • ● Customer-held encryption keys (CMEK)
  • ● Subprocessor list, 30-day change notice
Subprocessors

8 vendors, none on AI payloads.

Raidu deploys in your own cloud account, and none of the vendors below process AI payloads. The list below is the business layer around the product, and it is the operative Annex III to our Data Processing Addendum.

VendorPurposeData categoriesLocation
Google Cloud Platform Google LLC Hosting, storage, and compute for raidu.com and Raidu's corporate and support systems Business contact data, support correspondence, website and application telemetry United States
Google Workspace Google LLC Business email, calendar, and document storage used for account, support, and contract correspondence Business contact data, support correspondence, contract documents United States
HubSpot HubSpot, Inc. Customer relationship management and marketing automation Business contact data, marketing and engagement data United States
Atlassian Atlassian, Inc. Issue and project tracking, including support and defect tickets Business contact data and support ticket content United States
Slack Slack Technologies, LLC (a Salesforce company) Internal business communication, including shared support channels where a customer requests one Business contact data and correspondence United States
Sentry Functional Software, Inc. dba Sentry Application error monitoring for raidu.com and Raidu-operated systems Technical error telemetry. Personal data is excluded by configuration. United States
DocuSign DocuSign, Inc. Electronic execution of contracts and agreements Signatory name, work email, IP address, and signing audit trail United States
Scrut Automation Scrut Automation, Inc. Compliance evidence and control management Compliance artifacts and business contact data of Raidu personnel and reviewers United States
Full list, exclusions and change notice ↗ Updated 4 Sep 2026 · 30-day change notice
Documents

Everything you need for review.

Contacts

Ask us directly.

Security
security@raidu.com
Vulnerability disclosure
Privacy
privacy@raidu.com
Ali Sarafzadeh · Privacy Lead
Compliance
compliance@raidu.com
Frameworks and assessment reports
Legal
legal@raidu.com
DPA, SCCs