Security & Trust
Your compliance tool should be compliant too
Conforma holds the most sensitive map of your AI estate. We protect it with enterprise-grade controls and full transparency about how your data is handled.
Encryption everywhere
All data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Secrets are managed in a dedicated key-management service.
EU data residency
Enterprise data is stored and processed in EU regions, so your compliance record never leaves the jurisdiction it covers.
Least-privilege access
Role-based access control, SSO/SAML and enforced MFA mean people see only what their role requires — and you can prove it.
Full audit trail
Every change to a classification, obligation or document is logged with actor and timestamp — your evidence for an audit.
Tenant isolation
Customer data is logically isolated per organisation, with strict access boundaries enforced at the application and data layers.
Resilient by design
Automated backups, monitored infrastructure and a tested recovery process keep your registry available and intact.
Data protection & privacy
You own your data. We process it solely to provide the service, never to train third-party models, and we make it exportable at any time. Enterprise customers receive a custom Data Processing Agreement (DPA) covering roles, sub-processors and security commitments under the GDPR.
Sub-processors
We use a small, vetted set of sub-processors to deliver the service. Each is bound by data-protection terms consistent with our commitments to you.
Representative list for the current product stage; the binding list is maintained in your DPA.
Responsible disclosure
Found a vulnerability? We want to hear from you. Report it to security@conforma.eu and we'll acknowledge within one business day.