Security & Trust
Audit-ready by default
Give clients, auditors, and regulators the evidence they need.
Core principles
Security controls that hold under real audit pressure
No raw prompt storage
We never store original prompt bodies by default. Only redacted, policy-processed records are logged under your retention configuration.
End-to-end encryption
Data in transit uses TLS 1.3. Protected records are encrypted at rest with AES-256 and managed under tenant-scoped controls.
Tenant isolation
Tenant data and controls are logically isolated. Access boundaries are enforced at architecture level, not by convention.
Immutable audit chain
Audit entries are append-only with per-request policy history, enabling consistent evidence for internal review, client due diligence, and regulatory checks.
Architecture
How the gateway works
Every request flows through the gateway before reaching an AI provider. Raw prompt bodies are not stored by default.
Your data stays where you need it
EU data residency is available across plans. When enabled, processing and audit storage remain in EU-region infrastructure under your configured governance rules.
Compliance roadmap
Status snapshot for governance and certification
GDPR
Live
SOC 2 Type I
Q3 2026
SOC 2 Type II
Q4 2026
ISO 27001
2027
Encryption standards
Encryption at every layer
TLS 1.3 in transit
All API and extension traffic is encrypted in transit using TLS 1.3.
AES-256 at rest
Protected records are encrypted at rest using AES-256 controls.
Tenant-scoped keys
Each tenant uses isolated key scope; no key material is shared across tenants.
Key rotation controls
Key rotation can be scheduled or requested under enterprise governance workflows.
Security FAQ
Questions security and compliance teams ask first
Questions security and compliance teams ask first
Security FAQ
Qadar AI inspects prompts at policy time and avoids raw prompt storage by default. Audit entries capture policy outcomes and redacted metadata under your configured retention policy.
Audit access is tenant-scoped and role-controlled in Shield Control. Access events are logged, and exports can be routed to your existing SIEM or compliance systems.
Fail behavior is policy-defined per tenant and workflow. You can enforce fail-closed for high-risk routes and controlled fail-open for lower-risk workflows where continuity is required.
Current deployments are managed cloud. Enterprise teams can scope dedicated environment and residency controls during security review.
Keys are tenant-scoped, logically isolated, and rotated on schedule. Key material is never shared across tenants or exposed in customer-facing workflows.
Qadar AI enforces TLS 1.3 in transit and AES-256 for protected data at rest, with tenant-scoped key management and documented rotation procedures.
Book a security review
Have more security questions? Talk to a specialist
A product and security specialist will reply within one business day