Compliance artifacts for security and procurement

Control documentation and evidence collection are active for a SOC 2 Type I report.

• Security controls are mapped to SOC criteria and tracked through runbooks.
• Evidence collection workflows are active in the engineering process.
• Security review requests are handled through enterprise support.

A GDPR Data Processing Agreement (DPA) is available for enterprise customers.

• DPA requests are handled via enterprise@octyl.ai.
• The baseline DPA template is available on request for legal review.
• Subprocessor and transfer terms are covered in contract review.

Deployments are region-aware, with dedicated region options for enterprise requirements.

• Default managed deployment currently runs in AWS US regions.
• Dedicated deployment options include regional controls for enterprise needs.
• GovCloud-compatible deployment support is available for qualifying customers.

Zero-knowledge controls are part of the platform architecture, not policy-only commitments.

• Secrets are encrypted before storage and isolated at runtime.
• Factory lanes run in AWS Nitro-backed isolated environments on the Forge.
• BYOK keeps model billing and key custody with the customer.