Security & Privacy
Enterprise-grade security.Privacy by default.
Alomana runs in a private, isolated instance, your data is never used to train models, never shared with other customers, and never leaves your control. ISO/IEC 27001 certified and GDPR compliant.
Data privacy
Your data stays yours. Siloed per customer, never shared, and never used to train any model.
No training on your data
Your prompts, documents, and outputs never train, fine-tune, or improve any model.
Private, isolated storage
Data is siloed per customer, never co-mingled. Single-tenant deployment available.
EU-based hosting available
Run the platform and supported models entirely in EU regions.
Full data visibility
See and control exactly how data is accessed and used across your operations.
Security architecture
Secure at every layer. Zero-trust access and encryption protect data end-to-end across the platform.
Zero-trust, least-privilege
Access is limited to essential personnel and verified at every step.
Encrypted everywhere
AES-256 at rest, TLS 1.2+ in transit — across storage and networks.
Defense-in-depth
Multiple layers of controls protect data end-to-end across the platform.
Hardened, continuous refinement
Secure procedures govern data handling; controls evolve with the threat landscape.
Assurance & testing
Verified from the outside. An independent auditor certifies our controls, and third-party specialists test for vulnerabilities.
ISO/IEC 27001 certified
Independently certified information-security management controls.
GDPR compliant
Exercise data rights and rely on consistent, documented protection.
Independent penetration testing
Regular third-party specialists test for vulnerabilities.
Vendor & sub-processor reviews
Sub-processors are continuously evaluated and published for transparency.
Governance & control
You stay in control. Admins set access, integrations mirror your permissions, and every run is fully auditable.
Workspace-level permissions
Admins manage settings and access across the entire organization.
Mirrored access permissions
Integrations reflect your source-tool permissions 1:1 for consistency.
Bring your own keys (BYOK)
Use your own model-provider keys; reach every model through one interface.
Full audit trail
Every input, model call, and output is logged — built-in monitoring detects threats.
SSO / SAML
Single sign-on for your organization on the Enterprise plan.
ISO/IEC 27001:2022 certified.
Alomana maintains an independently certified information-security management system, is GDPR compliant, and offers single-tenant, EU-based deployment for organizations with the strictest requirements. To see what the EU regulation asks of companies using AI, read our EU AI Act guide for businesses.
Certificate no. IS-IA-2025-09-01-02, issued by Insight Assurance (IAS-accredited, MSCB-306), valid from 1 September 2025 to 31 August 2028. Scope: the ISMS supporting the Alomana platform and its framework for multi-agent application reasoning systems, per Statement of Applicability v1.0 (1 June 2025).
See our sub-processors, or request our security documentation: ISO/IEC 27001 certificate, Statement of Applicability, and Data Processing Addendum.
Asked, answered.
Do you train on our data?
No. Your prompts, documents, and outputs are never used to train, fine-tune, or improve any model, ours or a provider’s. Your data is used only to serve your own requests, inside your instance.
Where is our data hosted?
In a private, single-tenant instance isolated from other customers. EU-based hosting is available for the application and most models, so data can stay entirely within EU regions.
Is Alomana ISO 27001 certified?
Yes. Alomana holds an ISO/IEC 27001:2022 certification covering its information-security management system, validated by an independent auditor (Insight Assurance, certificate no. IS-IA-2025-09-01-02, valid until 31 August 2028). Alomana is also GDPR compliant.
Is Alomana GDPR compliant?
Yes. Alomana is GDPR-compliant, EU-based AI: a European AI platform with a single-tenant private instance, EU hosting, and AES-256 encryption. Your data stays under your control with full data sovereignty and never trains any model.
How is our data encrypted?
All data is encrypted with AES-256 at rest and TLS 1.2+ in transit, across both storage and networks. Access is governed by zero-trust, least-privilege principles with strong authentication.
Who can access our data?
Only essential personnel, under least-privilege access verified at every step. Integrations mirror your source-tool permissions 1:1, and every input, model call, and output is logged in a full audit trail.
Does Alomana provide audit logs?
Yes. Every agent run is fully auditable: each input, model call, tool action, and output is logged end-to-end, so compliance and security teams can reconstruct exactly what an agent did and why. Audit data stays inside your instance.
Can we use our own model keys?
Yes. Bring your own API keys (BYOK) for supported model providers and reach every major model through a single interface — no vendor lock-in, full control over usage.
Do you support single-tenant deployment?
Yes. Alomana can provision a dedicated, single-tenant instance in your preferred cloud for enterprise plans — no shared compute, full isolation, and your data stays inside your instance.
Is Alomana private by design?
Yes. Enterprise deployments run in a dedicated single-tenant instance; self-serve starts in a shared workspace and graduates to single-tenant for production. Your data never trains any model, bring-your-own-keys (BYOK) is supported, and EU hosting is available.
How do you test your security?
Independent third-party specialists run regular penetration tests and audits. Continuous monitoring watches for threats, and sub-processors are reviewed and published for full transparency.
Bring it to your security review.
We’ll walk your security and compliance teams through our controls, architecture, and certifications — on your requirements, with your questions.