Security
AI systems your security team can approve.
Every system we deliver runs in your own environment, governed by your identity and access controls, with each action recorded. Its controls are agreed in writing before the build begins, and your data remains yours throughout.
Controls fixed in the design
Security is settled in the architecture review, before engineering begins, and every change to the system is tested against it.
-
Your environment, your accounts
Systems are deployed into your cloud or on-premises infrastructure, under your security controls. Accounts with model providers and cloud vendors are opened in your organization's name, so the code, data and infrastructure remain under your control.
-
Residency decided in advance
The architecture review records every location where data is stored or processed, and your security team approves it before the build. Where residency rules exclude a hosted model, the system runs an open-weight model on infrastructure you operate.
-
No training on client data
Client data is never used to train a model for ByteForge or for any other client. Model provider accounts are held in your name, so the data terms that apply are the terms your organization has accepted.
-
Permissions and approval gates
Agents act only through the tools you grant, with permissions scoped to the task. Consequential actions wait for human approval, and write access to an enterprise system follows a passed security review of its permission model.
-
A record of every action
Every plan, tool call and result is traced from the first build. For any decision, your teams can establish which data the model saw, what it did and who approved it.
-
Tested on every change
Security cases sit in the evaluation set beside functional ones and run on every change. They include attempts to exceed granted permissions and instructions concealed in the documents a system reads.
Compliance
Documented against the frameworks you answer to
Each system's controls are mapped to the standards and regulations that govern your organization. Its technical documentation is prepared for your board, auditors and regulators, and is drawn from the running system so that it stays accurate.
-
EU AI Act
Risk classification, technical documentation and human oversight measures for systems within its scope.
Details on EU AI Act, official page, opens in a new tab -
NIST AI Risk Management Framework
Controls and records organized under its Govern, Map, Measure and Manage functions.
Details on NIST AI Risk Management Framework, official page, opens in a new tab -
ISO/IEC 42001
Control mapping and evidence for your AI management system and its certification audit.
Details on ISO/IEC 42001, official page, opens in a new tab -
ISO/IEC 27001
System controls mapped to the Annex A controls of your information security management system.
Details on ISO/IEC 27001, official page, opens in a new tab -
SOC 2
Evidence of access, change and monitoring controls, in the form your service auditor requests.
Details on SOC 2, official page, opens in a new tab -
GDPR
Records of processing, retention rules and data flows that support your data protection impact assessments.
Details on GDPR, official page, opens in a new tab
Questions from security teams
The questions a security review raises, answered here in general terms. For your system, the architecture review answers each of them in writing.
What does ByteForge treat as client data?
Client data is everything your organization provides and everything the system produces from it. That includes documents, records, prompts, model outputs, traces and the evaluation sets built from your material. All of it belongs to you and stays within the environment and accounts you control.
Where is our data stored and processed?
Your organization decides. The architecture review lists every system the data passes through and every location where it is stored or processed, and your security team approves that record before the build begins. Where residency rules exclude hosted models, we select open-weight models that run on infrastructure you operate.
What access does ByteForge need to our systems?
Only the access each stage of the work requires. Your organization grants it through your own identity provider and under your access policies. Because every account belongs to you, you can review or withdraw that access at any time, and it ends at handover unless you choose to extend it.
Is our data used to train models?
No. Client data is never used to train a model for ByteForge or for any other client. Model provider accounts are opened in your name, so the data terms that govern them are the terms your organization has accepted, and you can confirm them with the provider directly.
Can a model be fine-tuned on our own data?
Yes, where evaluation shows that a general model does not meet the requirement. Fine-tuning runs at your direction and within your environment. The resulting model, its training data and its pipeline belong to your organization and serve no other.
How is an agent prevented from taking an unauthorized action?
An agent can act only through the tools it has been granted, with permissions no broader than its task requires. Actions with material consequences wait for human approval, and every action is traced. The evaluation set tests these boundaries on every change.
How is the system tested for security before release?
Security cases are written into the evaluation set alongside functional cases and run on every change, including attempts to override instructions through the content a system reads. Because the system runs in your environment, your security team or the testers you appoint can assess it by your own methods before it goes live.
Will ByteForge complete our vendor security assessment?
Yes. Security questionnaires and vendor assessments are completed in writing before the engagement begins. The controls the system depends on are then recorded in the architecture your security team reviews.
Bring your security team to the first conversation.
Security, risk and compliance leads are welcome on the consultation. Their requirements shape the architecture review and are recorded in the design they approve.