Isolation & Containment
Yes. Sessions run in cloud-native isolated runtimes: Azure AKS pods with Confidential VMs (e.g., DCasv5/ECasv5 series), AWS EKS with Firecracker microVMs and Nitro Enclaves, or OCI OKE containers with Confidential Compute shapes. Per-session/per-customer enclaves use network segmentation, resource pinning, and VPC-level separation to eliminate leakage.
Dedicated Kubernetes namespaces, VPC peering restrictions, and IAM-bound roles per tenant across providers. Zero shared memory or compute; runtime monitors (e.g., AWS Firecracker, Azure Host Guardian Service) enforce strict boundaries.
Yes. Integrated cloud defenses include rate limiting, auto-scaling, and quotas (e.g., AWS WAF/Shield, OCI WAF, Azure DDoS Protection Pro). Customizable SLAs cap bursts, with real-time anomaly detection.
Data Handling & Retention
No. Processing is strictly in-memory and ephemeral; all data auto-discards upon session termination with no disk writes, queues, or replication.
Secure deallocation using OS primitives (e.g., Linux madvise() for memory zeroing) and provider-specific sanitization (e.g., Azure temp disk encryption, AWS ephemeral EBS volumes), compliant with NIST SP 800-88 Revision 1. No residual traces persist post-session.
PII is handled transiently for the query only, without storage, logging, or downstream use. Optional real-time redaction integrates with cloud services (e.g., AWS Comprehend, OCI Data Safe, Azure Purview) for on-the-fly anonymization.
No. Models are static and pre-trained exclusively on public datasets; customer inputs never enter training, fine-tuning, analytics, or any internal pipelines.
Encryption & Protection
Yes. End-to-end TLS 1.3 enforced across providers, with hybrid post-quantum key exchange (e.g., NIST Kyber/ML-KEM) available via AWS PQ-TLS, Azure hybrid modes, and OCI Vault integrations. Optional mutual TLS (mTLS) and certificate management (e.g., AWS ACM, Azure Key Vault) ensure client-server verification.
Yes, for fleeting artifacts only (e.g., session queues): Server-side encryption with customer-managed keys (CMKs) via Azure Key Vault, AWS KMS, or OCI Vault. Supports bring-your-own-key (BYOK) and per-tenant isolation for rotation/revocation control. No long-term at-rest storage occurs.
Yes. Hardware TEEs provide data-in-use encryption: Azure Confidential VMs (AMD SEV-SNP/Intel TDX with vTPM and remote attestation via Azure Attestation), AWS Nitro Enclaves (isolated execution with cryptographic attestation), OCI Confidential Compute (Intel SGX/TDX/SEV-ES with attestation). Verifies runtime integrity pre-execution.
Yes. Constant-time algorithms, hypervisor-level patches (e.g., Azure Host updates, AWS Nitro firmware), and TEE isolation mitigate timing/cache leaks. Annual third-party supply-chain audits cover hardware vulnerabilities.
Logging & Auditing
No. Content/PII logging is disabled by default; anonymized system metrics (e.g., aggregate latency/uptime) purge after 24 hours if enabled for troubleshooting.
Optional metadata-only trails (e.g., API timestamps, success rates) via provider integrations: Azure Monitor/Log Analytics, AWS CloudTrail/CloudWatch, OCI Logging/Audit. Exports to customer SIEMs (e.g., Splunk, ELK) supported, excluding any session content.
Encrypted at rest/transit with granular RBAC via cloud IAM (Azure AD, AWS IAM, OCI IAM policies). Customers get read-only tenant views; Ultrasafe access limited to <3% of staff via MFA, just-in-time elevation, and session recording.
Compliance & Controls
Inherits from providers (ISO 27001, SOC 1/2/3, GDPR, HIPAA, PCI DSS 4.0 via conformance mappings, FedRAMP Moderate/High in GovCloud regions). Ultrasafe conducts annual third-party audits, providing SOC 2 Type II reports and GDPR/HIPAA DPIAs (annual and post-change). Supports customer-led Privacy Impact Assessments (PIAs).
Yes. API/UI-configurable policies for response limits, topic restrictions, and toxicity detection, integrating Azure Content Safety, AWS Comprehend/Rekognition, or OCI AI Language/Data Labeling.
MFA required via cloud identity providers (e.g., AWS Cognito, OCI IDCS, Azure AD). APIs use OAuth 2.0/JWT with claim verification, IP allowlisting, key rotation, and zero-trust sessions. All personnel complete annual security awareness training, including phishing and insider threat simulations.
Yes. Continuous automated scanning (Azure Defender, AWS Inspector, OCI Vulnerability Scanning Service) with weekly patching. Material CVEs (including AI risks like prompt injection) notified within 72 hours. Sub-processors limited to cloud providers (Azure/AWS/OCI); full list under NDA.
Incident Response & Support
24/7 monitoring via unified SIEM (Azure Sentinel, AWS GuardDuty, OCI Cloud Guard) with automated alerts and <15-minute triage. Root-cause analysis, remediation, and customer notification within 4 hours per SLA; post-incident reports include lessons learned.
Follows NIST SP 800-61/SP 800-53: Immediate containment, independent forensics (e.g., Mandiant), regulatory notifications as required, and tabletop exercises available. Zero-retention minimizes scope; customer-specific configs (e.g., filters, keys) backed up encrypted with <1-hour RTO/RPO via Azure Backup/AWS Backup/OCI Recovery.
99.99% availability with multi-cloud failover (upgradable to 99.999% for hybrid). Enterprise tiers: <1-hour P1 response, optional Technical Account Manager (TAM); custom SLAs for high-assurance environments. Data residency enforced in customer-selected regions (e.g., no cross-border replication).
Assets include penetration test reports (annual + post-major changes, via third-parties like Mandiant; private bug bounty program), redacted architecture diagrams/IaC templates, cloud compliance portal access, and quarterly 2025 attestations. NDA-covered virtual/on-site audits or coordinated vulnerability disclosures supported.
Additional Security & Compliance Controls
Ultrasafe performs continuous adversarial testing across all deployed models, including prompt injection resistance, jailbreak prevention, data poisoning detection, and model inversion risk assessments. All models operate as fixed-weight systems inside attested TEEs, preventing extraction, tampering, or training-data inference. Annual third-party audits include AI-specific attack scenarios aligned with SOC 2 and ISO 27001 requirements.
No. Ultrasafe uses no external subcontractors for model operations, data handling, or infrastructure management beyond Azure, AWS, and OCI. There are no additional processors or sub-processors, eliminating supply-chain risk. Full cloud provider lists and attestations are shared under NDA for enterprise reviews.
Yes. Ultrasafe supports hybrid post-quantum TLS (e.g., NIST ML-KEM/Kyber) and maintains cryptographic agility, enabling rapid migration to new post-quantum algorithms without architectural changes. Encryption modules are abstraction-layered, allowing ciphers, key exchanges, and signature schemes to be updated as standards evolve.
All changes follow a strict GitOps/IaC workflow: configurations are version-controlled, peer-reviewed, and deployed through CI/CD pipelines with mandatory approval gates. Automated policy enforcement checks security baselines before deployment. This ensures traceability, rollback capability, and consistent enforcement of change-management controls.
Ultrasafe conducts semi-annual disaster recovery and failover exercises, including regional failover, enclave re-attestation, and workload continuity validation. All results are documented and available for enterprise audit under NDA. Multi-cloud redundancy supports availability SLAs of 99.99%–99.999% depending on deployment tier.