Every message checked. Every step on record.
Guardrails run on your server before and after the model. Personal data is filtered, and an audit log your auditor can verify records every step.
Four layers, one click apart.
Sixteen filters before the model sees a word.
Contact, identity, financial and health identifiers become placeholders before the model, the history or the logs.
Card numbers removed, typed or spoken.
Caught even when read out as "four one double one", checked with the Luhn formula, and replaced before storage. Payments go through a payment link.
- Designed to keep the agent out of PCI DSS scope. Your assessor confirms.
The log proves what happened without storing what was said.
Append-only, in its own database, chained with SHA-256. Edits and deletes are refused even for the owner.
- One-click verify pinpoints a missing or changed entry.
- CSV export, protected against formula injection.
Tools that cannot go rogue.
Deny-by-default tool lists, server-side validation, customer confirmation and a call budget, then a network guard on every outbound call.
Three stores, kept apart.
Every team's records are isolated. Ask for another team's record and the answer is "not found".
Platform database
Users, teams, roles and workflows. Connector credentials encrypted with AES-256-GCM.
AI service database
Agents, masked conversations and knowledge. Tool evidence encrypted with AES-256-GCM.
Audit database
Append-only and hash-chained. Edits and deletes are refused.
Controls designed to support HIPAA, SOC 2 and PCI DSS programmes.
Compliance belongs to your organisation. These are the controls Alphanetix gives your programme to build on.
| Control area | What Alphanetix provides | Supports |
|---|---|---|
| Access control | Team-scoped requests; masked history revealed only with permission. | HIPAA · SOC 2 |
| Audit controls | Append-only log of tool calls, reveals, exports, deletions and retention changes. | HIPAA · SOC 2 |
| Integrity | SHA-256 hash chain, verified in one click. | HIPAA · SOC 2 |
| Authentication | Studio sign-in; revocable access keys bound to each conversation. | HIPAA · SOC 2 |
| Transmission security | Encrypted voice transport; unencrypted connections refused in production. | HIPAA |
| Cardholder data | Card numbers removed before storage, the model and the logs. | PCI DSS |
Bring your security questionnaire.
We will walk your security team through each control, on your own infrastructure.