AI Security is integral to safeguarding our AI systems and data. Our approach includes:

• Data Protection: Ensuring all data processed by AI models is secure and private.
• Model Security: Protecting AI models from adversarial attacks and ensuring their integrity.
• Continuous Monitoring: Implementing continuous monitoring to detect and respond to any security threats in real time.

We proactively manage AI-related risks to ensure the security and reliability of our services. Our risk management practices include:

• Risk Register: A comprehensive register tailored to the deployment scenarios of Large Language Models (LLMs).
• Risk Identification: Identifying and documenting potential risks associated with using Self-hosted LLMs, Cloud Service Provider Provided LLMs, and Public LLMs.
• Risk Mitigation: Instituting appropriate controls and mitigation strategies to manage identified risks effectively.

AI Governance

Our AI Governance framework ensures the responsible use of AI across our Continuous Compliance SaaS platform. It includes:

• Policy Development: Establishing and enforcing policies that govern the use of AI.
• Ethical Guidelines: Adhering to ethical standards to ensure AI is used responsibly and without bias.
• Compliance: Ensuring all AI practices comply with relevant regulations and industry standards.

The Akitra Andromeda system hosted in AWS is containers based, managed AWS EKS.

MFA is enabled for user accounts via an SSO provider.

Akitra stores extensive logs of access and all activities performed in the service. Audit logging is monitored at the Cloud Service Provider account level as well as the Akitra application level. Logs are aggregated into a centrally. These logs are used by Akitra DevOps engineers for monitoring and alerting. Logs contain sufficient details to perform forensic investigations. Logs are stored in immutable services.

Access to the Akitra infrastructure as well as to the application is logged, audited and monitored for exceptions. At the cloud account level, we leverage cloud service provider (AWS) access monitoring services, such as AWS CloudTrail. We use application logs to record and monitor users' as well as API access to the Akitra system.

Data is replicated across Multi-AZ. Full backup is retained and saved in the cloud service environment on a daily basis.

Our infrastructure is primarily hosted in AWS in multiple regions throughout the United States.

We utilize infrastructure-as-code techniques to securely deploy resources in our environment.

We have a formal Business Continuity and Disaster Recovery plan, which is exercised, reviewed and approved annually.

Akitra has a Breach Notification Policy that is compliant with prevailing privacy laws and regulations, including the GDPR and the CCPA. In the case of an incident that has an impact on customer data and/or service, the customer will be notified asap and no later than 72 hours from confirmation of the incident by Akitra.

Our cookie policy is available online at our website.

Personnel perform security and privacy awareness training on an annual basis. Topics covered include: Passwords, Mobile devices, Social Engineering, Physical security, Phishing, GDPR and CCPA.

All new employees must pass a background check, sign a non-disclosure agreement, and abide by our company policies and procedures.

We have a documented Incident Response Plan that is reviewed, tested and approved at least annually.