Security & Privacy

Enterprise-grade security.
Privacy by default.

Alomana runs in a private, isolated instance, your data is never used to train models, never shared with other customers, and never leaves your control. ISO/IEC 27001 certified and GDPR compliant.

Talk to our security teamRead the FAQ
ISO 27001GDPREU hostingSingle-tenant
What every security review checks

Built to pass
procurement.

Data privacy

  • No training on your dataYour prompts, documents, and outputs never train, fine-tune, or improve any model.
  • Private, isolated storageData is siloed per customer, never co-mingled. Single-tenant deployment available.
  • EU-based hosting availableRun the platform and supported models entirely in EU regions.
  • Full data visibilitySee and control exactly how data is accessed and used across your operations.

Security architecture

  • Zero-trust, least-privilegeAccess is limited to essential personnel and verified at every step.
  • Encrypted everywhereAES-256 at rest, TLS 1.2+ in transit — across storage and networks.
  • Defense-in-depthMultiple layers of controls protect data end-to-end across the platform.
  • Hardened, continuous refinementSecure procedures govern data handling; controls evolve with the threat landscape.

Assurance & testing

  • ISO/IEC 27001 certifiedIndependently certified information-security management controls.
  • GDPR compliantExercise data rights and rely on consistent, documented protection.
  • Independent penetration testingRegular third-party specialists test for vulnerabilities.
  • Vendor & sub-processor reviewsSub-processors are continuously evaluated and published for transparency.

Governance & control

  • Workspace-level permissionsAdmins manage settings and access across the entire organization.
  • Mirrored access permissionsIntegrations reflect your source-tool permissions 1:1 for consistency.
  • Bring your own keys (BYOK)Use your own model-provider keys; reach every model through one interface.
  • Full audit trailEvery input, model call, and output is logged — built-in monitoring detects threats.
ISO/IEC 27001:2022 certified badge - Alomana enterprise AI platform

ISO/IEC 27001:2022 certified.

Alomana maintains an independently certified information-security management system, is GDPR compliant, and offers single-tenant, EU-based deployment for organizations with the strictest requirements. To see what the EU regulation asks of companies using AI, read our EU AI Act guide for businesses.

ISO/IEC 27001:2022GDPR compliantSingle-tenantEU hosting
Security questions buyers ask

Asked, answered.

Do you train on our data?

No. Your prompts, documents, and outputs are never used to train, fine-tune, or improve any model, ours or a provider’s. Your data is used only to serve your own requests, inside your instance.

Where is our data hosted?

In a private, single-tenant instance isolated from other customers. EU-based hosting is available for the application and most models, so data can stay entirely within EU regions.

Is Alomana ISO 27001 certified?

Yes. Alomana holds an ISO/IEC 27001:2022 certification covering its information-security management system, validated by an independent auditor (Insight Assurance). Alomana is also GDPR compliant.

Is Alomana GDPR compliant?

Yes. Alomana is GDPR-compliant, EU-based AI: a European AI platform with a single-tenant private instance, EU hosting, and AES-256 encryption. Your data stays under your control with full data sovereignty and never trains any model.

How is our data encrypted?

All data is encrypted with AES-256 at rest and TLS 1.2+ in transit, across both storage and networks. Access is governed by zero-trust, least-privilege principles with strong authentication.

Who can access our data?

Only essential personnel, under least-privilege access verified at every step. Integrations mirror your source-tool permissions 1:1, and every input, model call, and output is logged in a full audit trail.

Does Alomana provide audit logs?

Yes. Every agent run is fully auditable: each input, model call, tool action, and output is logged end-to-end, so compliance and security teams can reconstruct exactly what an agent did and why. Audit data stays inside your instance.

Can we use our own model keys?

Yes. Bring your own API keys (BYOK) for supported model providers and reach every major model through a single interface — no vendor lock-in, full control over usage.

Do you support single-tenant deployment?

Yes. Alomana can provision a dedicated, single-tenant instance in your preferred cloud for enterprise plans — no shared compute, full isolation, and your data stays inside your instance.

Is Alomana private by design?

Yes. Enterprise deployments run in a dedicated single-tenant instance; self-serve starts in a shared workspace and graduates to single-tenant for production. Your data never trains any model, bring-your-own-keys (BYOK) is supported, and EU hosting is available.

How do you test your security?

Independent third-party specialists run regular penetration tests and audits. Continuous monitoring watches for threats, and sub-processors are reviewed and published for full transparency.

Private by design · ISO 27001 · GDPR

Bring it to your
security review.

We’ll walk your security and compliance teams through our controls, architecture, and certifications — on your requirements, with your questions.

Talk to our security teamExplore the platform
ISO 27001GDPREU hostingSingle-tenant