Security practices

Last updated: 2026-07-17 · Public summary

1. Information security management

AI Warden operates an information security programme designed to support enterprise security review, customer due diligence, and regulated deployment discussions. Detailed assurance materials may be made available under appropriate confidentiality terms for qualified customers.

2. Governance & ownership

• Executive leadership owns information security governance.
• A named security owner manages the programme day to day and reports to leadership on security risk and remediation.
• Risk and policy materials are reviewed periodically and after material changes.

3. People

• Personnel screening is performed where appropriate for role, jurisdiction and applicable law.
• Security and privacy training is provided during onboarding and refreshed periodically, with role-specific material for higher-risk functions.
• Personnel are subject to confidentiality obligations that are intended to survive termination.

4. Access control

• Identity-rooted, least-privilege access is the intended operating model for production environments.
• Multi-factor authentication is required for employee access to sensitive systems, with stronger factors preferred for privileged access.
• Access is reviewed periodically and revoked through standard off-boarding and emergency access-removal processes.
• Privileged actions can require additional approval and can be recorded in audit logs depending on deployment configuration.

5. Cryptography

• Encryption in transit and at rest is supported, with customer-managed key options available for applicable deployments.
• Tenant and key separation controls are designed according to deployment model, with key-rotation processes available where configured.
• Cryptographic components are reviewed as part of security maintenance and dependency management.

6. Vulnerability management

• Dependency and vendor advisories are monitored and triaged according to severity and exposure.
• Vulnerability remediation targets are prioritized according to severity, exploitability, customer exposure and contractual commitments.
• External security testing and independent review materials may be provided under appropriate confidentiality terms where available.

7. Logging & monitoring

• Audit logging is designed to capture administrative and data-affecting actions according to deployment configuration.
• Customer-controlled SIEM export and tamper-evidence options can be configured where supported.
• Monitoring and incident response processes are operated according to deployment model and customer agreement.

8. Resilience & backup

• Recovery objectives depend on deployment model and are documented in the applicable customer agreement or order form.
• Backup and restore controls are configured according to deployment model and customer requirements.
• Disaster-recovery processes are reviewed periodically and tested where applicable.

9. Incident response

• Documented incident-response plan with severity matrix and named roles.
• Customer notification for confirmed personal-data breaches and security incidents is handled according to applicable law and signed customer agreements.
• Post-incident review and remediation information is shared with affected customers as appropriate and contractually required.

10. Third-party risk

• Sub-processors used for hosted services are reviewed according to vendor-risk processes and contractual requirements.
• Current sub-processor information is handled through the applicable DPA and customer contract materials.
• Sub-processor change notifications are provided according to signed customer agreements.

12. Physical security

Hosted production systems run in cloud environments operated by vetted infrastructure providers. AI Warden does not operate a physical data-centre footprint of its own.

13. Compliance

This public summary does not displace contractual obligations under an applicable DPA, Master Subscription Agreement or Order Form. In case of conflict, the signed contractual obligation prevails.

14. Contact

Security enquiries: security@aiwarden.com · contact security@aiwarden.com.